diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2014-05-12 20:45:35 +0000 |
|---|---|---|
| committer | Paul Kocialkowski <contact@paulk.fr> | 2014-07-17 16:54:18 +0200 |
| commit | 9ccc2c27fe27738389ac19df7dced05638bdc2db (patch) | |
| tree | 1833637f79bbdd873211a55b6dc827bee58d9bac | |
| parent | 8e9844c0d9ca75d490b071217c05f71b9d84f7fd (diff) | |
| download | kernel_samsung_tuna-9ccc2c27fe27738389ac19df7dced05638bdc2db.tar.gz kernel_samsung_tuna-9ccc2c27fe27738389ac19df7dced05638bdc2db.tar.bz2 kernel_samsung_tuna-9ccc2c27fe27738389ac19df7dced05638bdc2db.zip | |
futex: Prevent attaching to kernel threads
We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.
Found while analysing the fallout of Dave Jones syscall fuzzer.
We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.
Change-Id: I03941dc5737bcb9d3ddd2ec88f7c263c27a1247d
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
| -rw-r--r-- | kernel/futex.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/futex.c b/kernel/futex.c index b2d51a7ede3..b656168d929 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -650,6 +650,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, if (!p) return -ESRCH; + if (!p->mm) { + put_task_struct(p); + return -EPERM; + } + /* * We need to look at the task state flags to figure out, * whether the task is exiting. To protect against the do_exit |