mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
1,057,304 Commits 103 Branches 4,994 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Jann Horn 4a4073a2e2 ipc/sem: Fix dangling sem_array access in semtimedop race 
commit b52be557e2 upstream.

When __do_semtimedop() goes to sleep because it has to wait for a
semaphore value becoming zero or becoming bigger than some threshold, it
links the on-stack sem_queue to the sem_array, then goes to sleep
without holding a reference on the sem_array.

When __do_semtimedop() comes back out of sleep, one of two things must
happen:

 a) We prove that the on-stack sem_queue has been disconnected from the
    (possibly freed) sem_array, making it safe to return from the stack
    frame that the sem_queue exists in.

 b) We stabilize our reference to the sem_array, lock the sem_array, and
    detach the sem_queue from the sem_array ourselves.

sem_array has RCU lifetime, so for case (b), the reference can be
stabilized inside an RCU read-side critical section by locklessly
checking whether the sem_queue is still connected to the sem_array.

However, the current code does the lockless check on sem_queue before
starting an RCU read-side critical section, so the result of the
lockless check immediately becomes useless.

Fix it by doing rcu_read_lock() before the lockless check.  Now RCU
ensures that if we observe the object being on our queue, the object
can't be freed until rcu_read_unlock().

This bug is only hittable on kernel builds with full preemption support
(either CONFIG_PREEMPT or PREEMPT_DYNAMIC with preempt=full).

Fixes: 370b262c89 ("ipc/sem: avoid idr tree lookup for interrupted semop")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2022-12-08 11:28:45 +01:00
Documentation docs: update mediator contact information in CoC doc 2022-11-26 09:24:48 +01:00
LICENSES
…
arch riscv: kexec: Fixup irq controller broken in kexec crash path 2022-12-08 11:28:44 +01:00
block block, bfq: fix null pointer dereference in bfq_bio_bfqg() 2022-12-02 17:41:02 +01:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto crypto: akcipher - default implementation for setting a private key 2022-10-26 12:35:25 +02:00
drivers Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() 2022-12-08 11:28:45 +01:00
fs io_uring/poll: fix poll_refs race with cancelation 2022-12-08 11:28:43 +01:00
include mm: __isolate_lru_page_prepare() in isolate_migratepages_block() 2022-12-08 11:28:44 +01:00
init init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash 2022-12-02 17:41:08 +01:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel tracing: Free buffers when a used dynamic event is removed 2022-12-08 11:28:43 +01:00
lib Kconfig.debug: provide a little extra FRAME_WARN leeway when KASAN is enabled 2022-12-08 11:28:44 +01:00
mm mm: migrate: fix THP's mapcount on isolation 2022-12-08 11:28:44 +01:00
net ipv4: Fix route deletion when nexthop info is not specified 2022-12-08 11:28:44 +01:00
samples samples/landlock: Format with clang-format 2022-06-09 10:23:23 +02:00
scripts scripts/faddr2line: Fix regression in name resolution on ppc64le 2022-12-08 11:28:38 +01:00
security capabilities: fix potential memleak on error path from vfs_getxattr_alloc() 2022-11-10 18:15:39 +01:00
sound ASoC: ops: Fix bounds check for _sx controls 2022-12-08 11:28:43 +01:00
tools ipv4: Fix route deletion when nexthop info is not specified 2022-12-08 11:28:44 +01:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt kvm: Add support for arch compat vm ioctls 2022-10-29 10:12:54 +02:00
.clang-format
…
.cocciconfig
…
.get_maintainer.ignore
…
.gitattributes
…
.gitignore
…
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING
…
CREDITS
…
Kbuild
…
Kconfig
…
MAINTAINERS Input: goodix - add a goodix.h header file 2022-07-12 16:34:51 +02:00
Makefile Linux 5.15.81 2022-12-02 17:41:12 +01:00
README
…

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.