Re: [PATCH] Make futex waiters take an mm or inode reference

[Jamie Lokier <jamie@shareable.org>]

Linus Torvalds wrote:
> So is there any reason to really having "private.mm" AT ALL? From what I
> can tell, it is not actually ever used (all "mm" users are "current->mm"),
> so I don't see the point of incrementing a count for it either.
> 
> Or did I miss something?

Yes.  The hash table is global to all processes, so "mm" is needed as
a hash key whether it is user-visible or not.

A process can do FUTEX_FD and then pass that fd to another mm, in
numerous ways (fork, exec, socket).  Although that does have a
well-defined behaviour at present, I agree it's absolutely fine to
declare that "programmer error" and say it doesn't do anything useful.

But the implemenation is a security problem: a broken program will
cause _other_ unrelated programs to fail, by stealing their wakeups.

That is very bad.  A userspace error should never cause random
unrelated programs to fail.

Possible fixes include:
	- destroying futexes of an mm when the mm is destroyed
	- marking the fds in a special way to prevent them being passed on
	- taking an mm reference

Taking an mm reference is the simplest.

-- Jamie