diff options
| author | Thomas Gleixner <tglx@kernel.org> | 2026-08-07 17:07:13 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-08-16 00:16:31 +0200 |
| commit | c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc (patch) | |
| tree | 22e015e5f8800794579631a213863cd24de11010 /include | |
| parent | f9ece060cc43eae8a1f148737d193ba0d07b8f88 (diff) | |
| download | linux-stable-c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc.tar.gz linux-stable-c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc.zip | |
futex/pi: Plug private futex exec() race
The check for private futexes whether the waiter's mm, which is stored in
the futex_key and copied into the pi_state, is the same as the owner's mm
is not sufficient for exec(). exec() has a gap where the mm check fails to
give the correct answer:
exec()
...
exec_release_mm()
futex_exec_release()
tsk::futex::exit_state = EXITING;
cleanup_robust_list();
1) tsk::futex::exit_state = OK;
...
old_mm = tsk::mm;
2) tsk::mm = ->mm;
Between #1 and #2 the check for the mm is wrong as that mm is about to be
swapped out and eventually freed.
Plug this gap by:
1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in
futex_exec_release()
2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after
the mm has been switched.
From a futex point of view the task is dead after it finished the robust
list cleanup up to the point where it sets the state to OK again.
Fixes: 80367ad01d93 ("futex: Add basic infrastructure for local task local hash")
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Kyle Zeng <kylebot@openai.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/futex.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/futex.h b/include/linux/futex.h index 51f4ccdc9092..51d5faa1266f 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -73,6 +73,7 @@ static inline void futex_init_task(struct task_struct *tsk) void futex_exit_recursive(struct task_struct *tsk); void futex_exit_release(struct task_struct *tsk); void futex_exec_release(struct task_struct *tsk); +void futex_exec_done(struct task_struct *tsk); long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, u32 __user *uaddr2, u32 val2, u32 val3); @@ -91,6 +92,7 @@ static inline void futex_init_task(struct task_struct *tsk) { } static inline void futex_exit_recursive(struct task_struct *tsk) { } static inline void futex_exit_release(struct task_struct *tsk) { } static inline void futex_exec_release(struct task_struct *tsk) { } +static inline void futex_exec_done(struct task_struct *tsk) { } static inline long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, u32 __user *uaddr2, u32 val2, u32 val3) { |