• Thomas Gleixner's avatar
    futex: Prevent stale futex owner when interrupted/timeout · cdf71a10
    Thomas Gleixner authored
    Roland Westrelin did a great analysis of a long standing thinko in the
    return path of futex_lock_pi.
    
    While we fixed the lock steal case long ago, which was easy to trigger,
    we never had a test case which exposed this problem and stupidly never
    thought about the reverse lock stealing scenario and the return to user
    space with a stale state.
    
    When a blocked tasks returns from rt_mutex_timed_locked without holding
    the rt_mutex (due to a signal or timeout) and at the same time the task
    holding the futex is releasing the futex and assigning the ownership of
    the futex to the returning task, then it might happen that a third task
    acquires the rt_mutex before the final rt_mutex_trylock() of the
    returning task happens under the futex hash bucket lock. The returning
    task returns to user space with ETIMEOUT or EINTR, but the user space
    futex value is assigned to this task. The task which acquired the
    rt_mutex fixes the user space futex value right after the hash bucket
    lock has been released by the returning task, but for a short period of
    time the user space value is wrong.
    
    Detailed description is available at:
    
       https://bugzilla.redhat.com/show_bug.cgi?id=400541
    
    The fix for this is the same as we do when the rt_mutex was acquired by
    a higher priority task via lock stealing from the designated new owner.
    In that case we already fix the user space value and the internal
    pi_state up before we return. This mechanism can be used to fixup the
    above corner case as well. When the returning task, which failed to
    acquire the rt_mutex, notices that it is the designated owner of the
    futex, then it fixes up the stale user space value and the pi_state,
    before returning to user space. This happens with the futex hash bucket
    lock held, so the task which acquired the rt_mutex is guaranteed to be
    blocked on the hash bucket lock. We can access the rt_mutex owner, which
    gives us the pid of the new owner, safely here as the owner is not able
    to modify (release) it while waiting on the hash bucket lock.
    
    Rename the "curr" argument of fixup_pi_state_owner() to "newowner" to
    avoid confusion with current and add the check for the stale state into
    the failure path of rt_mutex_trylock() in the return path of
    unlock_futex_pi(). If the situation is detected use
    fixup_pi_state_owner() to assign everything to the owner of the
    rt_mutex.
    Pointed-out-and-tested-by: default avatarRoland Westrelin <roland.westrelin@sun.com>
    Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    cdf71a10
futex.c 50.6 KB