In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex: Prevent rcuwait use-after-free during requeue PI<\/p>\n
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of
\nrcuwait_wake_up().<\/p>\n
The futex_q used by futex_wait_requeue_pi() is allocated on the waiter’s
\nstack. An early wakeup can race with a PI requeue as follows:<\/p>\n
waiter requeue task
\n —— ————
\nfutex_wait_requeue_pi()
\n futex_do_wait()
\n schedule()
\n futex_requeue
\n futex_proxy_trylock_atomic()
\n futex_requeue_pi_prepare()
\n Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS
\n* timeout\/ signal wakes waiter *
\n futex_requeue_pi_wakeup_sync()
\n Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT
\n requeue_pi_wake_futex
\n futex_requeue_pi_complete()
\n cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED
\n rcuwait_wait_event()
\n if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)
\n break \/* no schedule() *\/<\/p>\n
\/* q.pi_state->owner == current *\/
\n futex_private_hash_put()
\n \/* return from syscall *\/
\n rcuwait_wake_up(&q->requeue_wait)
\n \/* q is gone *\/<\/p>\n
futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before
\ncalling rcuwait_wake_up(). The waiter observes this state in
\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().
\nHere, the waiter is free leave the syscall before requeue task can
\ncomplete the wake.<\/p>\n
To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED
\ncase.
\nThis state is only published by requeue_pi_wake_futex(), which saves
\nq->task before futex_requeue_pi_complete() and wakes the waiter via
\nwake_up_state().<\/p>\n
This wake is intended to wake the waiter from its futex_do_wait() sleep.
\nIf the waiter is still sleeping there, it can not get into the
\nQ_REQUEUE_PI_WAIT state (and require this removed wake).
\nShould the waiter be woken up from futex_do_wait() by other means (as in
\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the
\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.
\nShould the waiter task terminate before wake_up_state() had a chance to
\nwake the task then the task pointer does not become invalid because the
\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.<\/p>\n
[bigeasy: Updated comment and commit message]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
futex: Prevent rcuwait use-after-free during requeue PI<\/p>\n
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
\n(slab-out-o<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24691","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24691","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24691"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24691"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24691"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}