From: Peter Zijlstra <peterz@infradead.org>
To: Darren Hart <dvhart@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
Date: Thu, 1 Dec 2016 06:34:27 +0100 [thread overview]
Message-ID: <20161201053427.GD3092@twins.programming.kicks-ass.net> (raw)
In-Reply-To: <20161201045530.GA124104@f23x64.localdomain>
On Wed, Nov 30, 2016 at 08:55:30PM -0800, Darren Hart wrote:
> On Thu, Nov 24, 2016 at 04:38:08PM +0100, Peter Zijlstra wrote:
> > > In this path the fixup can return -EFAIL as well, so it should drop rtmutex
> > > too if it owns it. We should move the rtmutex drop into the fixup functions...
> >
> > Urgh, so would really like to avoid doing that, I'll have to instantly
> > drag it back out again :/
>
> Why would you have to drag it back out again? Something else you're working on?
Yeah, the very reason I've been staring at this mess in the first place
:-)
So I could point you at the patches; and I will, see:
https://lkml.kernel.org/r/20161021122735.GA3117@twins.programming.kicks-ass.net
but the TL;DR version is that we must not rt_mutex_unlock() while
holding hb->lock, because on RT hb->lock is itself a rt_mutex which
gives rise to some very fun prio inversions.
next prev parent reply other threads:[~2016-12-01 5:34 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-24 14:42 [PATCH] futex: Fix potential use-after-free in FUTEX_REQUEUE_PI Peter Zijlstra
2016-11-24 15:19 ` Thomas Gleixner
2016-11-24 15:38 ` Peter Zijlstra
2016-12-01 4:55 ` Darren Hart
2016-12-01 5:34 ` Peter Zijlstra [this message]
2016-12-01 6:07 ` Darren Hart
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161201053427.GD3092@twins.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=dvhart@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox