Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-28 13:51:44 +00:00
Code Issues Packages Projects Releases Wiki Activity
A mirror of the official Linux kernel repository just in case
707,947 Commits 2 Branches 866 Tags 6.6 GiB
C 97.5%
Assembly 1%
Shell 0.6%
Python 0.3%
Makefile 0.3%
e78c38f6bd
Go to file
Jiri Slaby e78c38f6bd futex: futex_wake_op, do not fail on invalid op 
In commit 30d6e0a419 ("futex: Remove duplicated code and fix undefined
behaviour"), I let FUTEX_WAKE_OP to fail on invalid op.  Namely when op
should be considered as shift and the shift is out of range (< 0 or > 31).

But strace's test suite does this madness:

  futex(0x7fabd78bcffc, 0x5, 0xfacefeed, 0xb, 0x7fabd78bcffc, 0xa0caffee);
  futex(0x7fabd78bcffc, 0x5, 0xfacefeed, 0xb, 0x7fabd78bcffc, 0xbadfaced);
  futex(0x7fabd78bcffc, 0x5, 0xfacefeed, 0xb, 0x7fabd78bcffc, 0xffffffff);

When I pick the first 0xa0caffee, it decodes as:

  0x80000000 & 0xa0caffee: oparg is shift
  0x70000000 & 0xa0caffee: op is FUTEX_OP_OR
  0x0f000000 & 0xa0caffee: cmp is FUTEX_OP_CMP_EQ
  0x00fff000 & 0xa0caffee: oparg is sign-extended 0xcaf = -849
  0x00000fff & 0xa0caffee: cmparg is sign-extended 0xfee = -18

That means the op tries to do this:

  (futex |= (1 << (-849))) == -18

which is completely bogus. The new check of op in the code is:

        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
                if (oparg < 0 || oparg > 31)
                        return -EINVAL;
                oparg = 1 << oparg;
        }

which results obviously in the "Invalid argument" errno:

  FAIL: futex
  ===========

  futex(0x7fabd78bcffc, 0x5, 0xfacefeed, 0xb, 0x7fabd78bcffc, 0xa0caffee) = -1: Invalid argument
  futex.test: failed test: ../futex failed with code 1

So let us soften the failure to print only a (ratelimited) message, crop
the value and continue as if it were right.  When userspace keeps up, we
can switch this to return -EINVAL again.

[v2] Do not return 0 immediatelly, proceed with the cropped value.

Fixes: 30d6e0a419 ("futex: Remove duplicated code and fix undefined behaviour")
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <dvhart@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-11-02 07:41:50 -07:00
arch x86/mm: fix use-after-free of vma during userfaultfd fault 2017-11-01 08:09:58 -07:00
block bio_copy_user_iov(): don't ignore ->iov_offset 2017-10-10 23:55:14 -04:00
certs modsign: add markers to endif-statements in certs/Makefile 2017-07-14 11:01:37 +10:00
crypto Merge commit 'tags/keys-fixes-20171018' into fixes-v4.14-rc5 2017-10-19 12:28:38 +11:00
Documentation Revert "PM / QoS: Fix device resume latency PM QoS" 2017-10-31 18:35:40 +01:00
drivers Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2017-11-01 14:46:38 -07:00
firmware firmware: Restore support for built-in firmware 2017-09-16 10:58:48 -07:00
fs cifs: check MaxPathNameComponentLength != 0 before using it 2017-10-30 02:11:38 -05:00
include Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-01 08:29:01 -07:00
init kbuild: Fix optimization level choice default 2017-10-07 20:08:05 +09:00
ipc fix a typo in put_compat_shm_info() 2017-09-25 20:41:46 -04:00
kernel futex: futex_wake_op, do not fail on invalid op 2017-11-02 07:41:50 -07:00
lib Mark 'ioremap_page_range()' as possibly sleeping 2017-10-30 10:09:56 -07:00
mm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-10-21 22:44:48 -04:00
net tcp: fix tcp_mtu_probe() vs highest_sack 2017-11-01 21:18:34 +09:00
samples Fix tracing sample code warning. 2017-10-27 20:35:31 -07:00
scripts Kbuild fixes for v4.14 (2nd) 2017-10-28 11:01:57 -07:00
security Revert "apparmor: add base infastructure for socket mediation" 2017-10-26 19:35:35 +02:00
sound ALSA: hda - fix headset mic problem for Dell machines with alc236 2017-10-24 14:32:24 +02:00
tools bpf: remove SK_REDIRECT from UAPI 2017-11-01 11:43:50 +09:00
usr ramfs: clarify help text that compression applies to ramfs as well as legacy ramdisk. 2017-07-06 16:24:30 -07:00
virt Revert "KVM: Don't accept obviously wrong gsi values via KVM_IRQFD" 2017-09-19 08:37:17 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: Add support to generate LLVM assembly files 2017-04-25 08:13:52 +09:00
.mailmap Update James Hogan's email address 2017-10-04 17:11:53 -07:00
COPYING
CREDITS selinux/stable-4.14 PR 20170831 2017-09-12 13:21:00 -07:00
Kbuild kbuild: Consolidate header generation from ASM offset information 2017-04-13 05:43:37 +09:00
Kconfig
MAINTAINERS MAINTAINERS: Remove Yotam from mlxfw 2017-11-01 12:19:03 +09:00
Makefile Linux 4.14-rc7 2017-10-29 13:58:38 -07:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.