Commit 7a0ea09ad5352efce8fe79ed853150449903b9f5

Authored by Michal Hocko
Committed by Linus Torvalds
1 parent f4985dc714

futex: futex_find_get_task remove credentails check

futex_find_get_task is currently used (through lookup_pi_state) from two
contexts, futex_requeue and futex_lock_pi_atomic.  None of the paths
looks it needs the credentials check, though.  Different (e)uids
shouldn't matter at all because the only thing that is important for
shared futex is the accessibility of the shared memory.

The credentail check results in glibc assert failure or process hang (if
glibc is compiled without assert support) for shared robust pthread
mutex with priority inheritance if a process tries to lock already held
lock owned by a process with a different euid:

pthread_mutex_lock.c:312: __pthread_mutex_lock_full: Assertion `(-(e)) != 3 || !robust' failed.

The problem is that futex_lock_pi_atomic which is called when we try to
lock already held lock checks the current holder (tid is stored in the
futex value) to get the PI state.  It uses lookup_pi_state which in turn
gets task struct from futex_find_get_task.  ESRCH is returned either
when the task is not found or if credentials check fails.

futex_lock_pi_atomic simply returns if it gets ESRCH.  glibc code,
however, doesn't expect that robust lock returns with ESRCH because it
should get either success or owner died.

Signed-off-by: Michal Hocko <mhocko@suse.cz>
Acked-by: Darren Hart <dvhltc@us.ibm.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 4 additions and 13 deletions Side-by-side Diff

... ... @@ -429,20 +429,11 @@
429 429 static struct task_struct * futex_find_get_task(pid_t pid)
430 430 {
431 431 struct task_struct *p;
432   - const struct cred *cred = current_cred(), *pcred;
433 432  
434 433 rcu_read_lock();
435 434 p = find_task_by_vpid(pid);
436   - if (!p) {
437   - p = ERR_PTR(-ESRCH);
438   - } else {
439   - pcred = __task_cred(p);
440   - if (cred->euid != pcred->euid &&
441   - cred->euid != pcred->uid)
442   - p = ERR_PTR(-ESRCH);
443   - else
444   - get_task_struct(p);
445   - }
  435 + if (p)
  436 + get_task_struct(p);
446 437  
447 438 rcu_read_unlock();
448 439  
... ... @@ -564,8 +555,8 @@
564 555 if (!pid)
565 556 return -ESRCH;
566 557 p = futex_find_get_task(pid);
567   - if (IS_ERR(p))
568   - return PTR_ERR(p);
  558 + if (!p)
  559 + return -ESRCH;
569 560  
570 561 /*
571 562 * We need to look at the task state flags to figure out,