Re: 2.6.0-test6 oops futex"

[Jamie Lokier <jamie@shareable.org>]

Rusty Russell wrote:
> +again:
> +	key = q->key;
> +	bh = hash_futex(&key);
>  	spin_lock(&bh->lock);
> +	if (unlikely(!match_futex(&key, q->key)) {
> +		/* Race against futex_requeue */
> +		spin_unlock(&bh_lock);
> +		goto again;
> +	}

Bug:

	1. key = q->key copies bad key, while it is being changed.

	2. That makes the spin_lock() irrelevant.

	3. match_futex() compares word by word against another bad
	   key, while it is being changed again (by a second futex_requeue).

	4. It can match even though the key is wrong.

For example, say the first requeue changes q->key from (1,2) to (3,4).
key = q->key could read (1,4).

Say the second requeue changes q->key from (3,4) to (1,5).
match_futex() could read (1,4) and pass the test, even though (1,4)
is never a valid key.

-- Jamie