Skip to content
Snippets Groups Projects
Commit 24a4020b authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Siqi Lin
Browse files

timerfd: Protect the might cancel mechanism proper


commit 1e38da300e1e395a15048b0af1e5305bd91402f6 upstream.

The handling of the might_cancel queueing is not properly protected, so
parallel operations on the file descriptor can race with each other and
lead to list corruptions or use after free.

Protect the context for these operations with a seperate lock.

The wait queue lock cannot be reused for this because that would create a
lock inversion scenario vs. the cancel lock. Replacing might_cancel with an
atomic (atomic_t or atomic bit) does not help either because it still can
race vs. the actual list operation.

Bug: 36266767

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: "linux-fsdevel@vger.kernel.org"
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos


Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSiqi Lin <siqilin@google.com>
Change-Id: I122753e0920e51757d3012cd1a133e823719be51
parent 26a2aa5d
No related branches found
No related tags found
No related merge requests found
...@@ -40,6 +40,7 @@ struct timerfd_ctx { ...@@ -40,6 +40,7 @@ struct timerfd_ctx {
short unsigned settime_flags; /* to show in fdinfo */ short unsigned settime_flags; /* to show in fdinfo */
struct rcu_head rcu; struct rcu_head rcu;
struct list_head clist; struct list_head clist;
spinlock_t cancel_lock;
bool might_cancel; bool might_cancel;
}; };
...@@ -113,7 +114,7 @@ void timerfd_clock_was_set(void) ...@@ -113,7 +114,7 @@ void timerfd_clock_was_set(void)
rcu_read_unlock(); rcu_read_unlock();
} }
static void timerfd_remove_cancel(struct timerfd_ctx *ctx) static void __timerfd_remove_cancel(struct timerfd_ctx *ctx)
{ {
if (ctx->might_cancel) { if (ctx->might_cancel) {
ctx->might_cancel = false; ctx->might_cancel = false;
...@@ -123,6 +124,13 @@ static void timerfd_remove_cancel(struct timerfd_ctx *ctx) ...@@ -123,6 +124,13 @@ static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
} }
} }
static void timerfd_remove_cancel(struct timerfd_ctx *ctx)
{
spin_lock(&ctx->cancel_lock);
__timerfd_remove_cancel(ctx);
spin_unlock(&ctx->cancel_lock);
}
static bool timerfd_canceled(struct timerfd_ctx *ctx) static bool timerfd_canceled(struct timerfd_ctx *ctx)
{ {
if (!ctx->might_cancel || ctx->moffs.tv64 != KTIME_MAX) if (!ctx->might_cancel || ctx->moffs.tv64 != KTIME_MAX)
...@@ -133,6 +141,7 @@ static bool timerfd_canceled(struct timerfd_ctx *ctx) ...@@ -133,6 +141,7 @@ static bool timerfd_canceled(struct timerfd_ctx *ctx)
static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
{ {
spin_lock(&ctx->cancel_lock);
if ((ctx->clockid == CLOCK_REALTIME || if ((ctx->clockid == CLOCK_REALTIME ||
ctx->clockid == CLOCK_REALTIME_ALARM || ctx->clockid == CLOCK_REALTIME_ALARM ||
ctx->clockid == CLOCK_POWEROFF_ALARM) && ctx->clockid == CLOCK_POWEROFF_ALARM) &&
...@@ -143,9 +152,10 @@ static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) ...@@ -143,9 +152,10 @@ static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags)
list_add_rcu(&ctx->clist, &cancel_list); list_add_rcu(&ctx->clist, &cancel_list);
spin_unlock(&cancel_lock); spin_unlock(&cancel_lock);
} }
} else if (ctx->might_cancel) { } else {
timerfd_remove_cancel(ctx); __timerfd_remove_cancel(ctx);
} }
spin_unlock(&ctx->cancel_lock);
} }
static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx) static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx)
...@@ -397,6 +407,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags) ...@@ -397,6 +407,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags)
return -ENOMEM; return -ENOMEM;
init_waitqueue_head(&ctx->wqh); init_waitqueue_head(&ctx->wqh);
spin_lock_init(&ctx->cancel_lock);
ctx->clockid = clockid; ctx->clockid = clockid;
if (isalarm(ctx)) { if (isalarm(ctx)) {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment