From patchwork Tue Jun 17 21:42:35 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 361376 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id 4984F1400E6; Wed, 18 Jun 2014 19:25:56 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1WxC7s-0006Bd-Nk; Wed, 18 Jun 2014 09:25:52 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1Wx19L-0007vS-5W for kernel-team@lists.ubuntu.com; Tue, 17 Jun 2014 21:42:39 +0000 Received: from c-67-160-228-185.hsd1.ca.comcast.net ([67.160.228.185] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Wx19J-0008TE-Jf; Tue, 17 Jun 2014 21:42:37 +0000 Received: from kamal by fourier with local (Exim 4.82) (envelope-from ) id 1Wx19H-0002zI-LL; Tue, 17 Jun 2014 14:42:35 -0700 From: Kamal Mostafa To: Thomas Gleixner Subject: [3.13.y.z extended stable] Patch "futex: Prevent attaching to kernel threads" has been added to staging queue Date: Tue, 17 Jun 2014 14:42:35 -0700 Message-Id: <1403041355-11453-1-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.9.1 X-Extended-Stable: 3.13 X-Mailman-Approved-At: Wed, 18 Jun 2014 09:25:40 +0000 Cc: Jakub Jelinek , Lai Jiangshan , Roland McGrath , Peter Zijlstra , Sebastian Andrzej Siewior , Steven Rostedt , Clark Williams , kernel-team@lists.ubuntu.com, Davidlohr Bueso , Carlos ODonell , Darren Hart , Dave Jones , Paul McKenney , Linus Torvalds , Kamal Mostafa , Michael Kerrisk X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled futex: Prevent attaching to kernel threads to the linux-3.13.y-queue branch of the 3.13.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.13.y-queue This patch is scheduled to be released in version 3.13.11.4. If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.13.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ------ From 43244ace3a7eacb328bb350cf8d93346ecee711a Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Mon, 12 May 2014 20:45:35 +0000 Subject: futex: Prevent attaching to kernel threads commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream. We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex. Found while analysing the fallout of Dave Jones syscall fuzzer. We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue. Signed-off-by: Thomas Gleixner Cc: Dave Jones Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Darren Hart Cc: Davidlohr Bueso Cc: Steven Rostedt Cc: Clark Williams Cc: Paul McKenney Cc: Lai Jiangshan Cc: Roland McGrath Cc: Carlos ODonell Cc: Jakub Jelinek Cc: Michael Kerrisk Cc: Sebastian Andrzej Siewior Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de Signed-off-by: Thomas Gleixner Signed-off-by: Kamal Mostafa --- kernel/futex.c | 5 +++++ 1 file changed, 5 insertions(+) -- 1.9.1 diff --git a/kernel/futex.c b/kernel/futex.c index 5055418..7876c15 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -668,6 +668,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, if (!p) return -ESRCH; + if (!p->mm) { + put_task_struct(p); + return -EPERM; + } + /* * We need to look at the task state flags to figure out, * whether the task is exiting. To protect against the do_exit