From: Peter Zijlstra <peterz@infradead.org>
To: Darren Hart <dvhart@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Date: Thu, 1 Dec 2016 06:34:27 +0100 [thread overview]
Message-ID: <20161201053427.GD3092@twins.programming.kicks-ass.net> (raw)
In-Reply-To: <20161201045530.GA124104@f23x64.localdomain>
On Wed, Nov 30, 2016 at 08:55:30PM -0800, Darren Hart wrote:
> On Thu, Nov 24, 2016 at 04:38:08PM +0100, Peter Zijlstra wrote:
> > > In this path the fixup can return -EFAIL as well, so it should drop rtmutex
> > > too if it owns it. We should move the rtmutex drop into the fixup functions...
> >
> > Urgh, so would really like to avoid doing that, I'll have to instantly
> > drag it back out again :/
>
> Why would you have to drag it back out again? Something else you're working on?
Yeah, the very reason I've been staring at this mess in the first place
:-)
So I could point you at the patches; and I will, see:
https://lkml.kernel.org/r/20161021122735.GA3117@twins.programming.kicks-ass.net
but the TL;DR version is that we must not rt_mutex_unlock() while
holding hb->lock, because on RT hb->lock is itself a rt_mutex which
gives rise to some very fun prio inversions.
next prev parent reply other threads:[~2016-12-01 5:34 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-24 14:42 [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Peter Zijlstra
2016-11-24 15:19 ` Thomas Gleixner
2016-11-24 15:38 ` Peter Zijlstra
2016-12-01 4:55 ` Darren Hart
2016-12-01 5:34 ` Peter Zijlstra [this message]
2016-12-01 6:07 ` Darren Hart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161201053427.GD3092@twins.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=dvhart@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.