| From bfc3326dea642b2183c4f0bb6b9e209ad83e4745 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 27 Sep 2020 02:08:58 +0200 |
| Subject: futex: Fix incorrect should_fail_futex() handling |
| |
| From: Mateusz Nosek <mateusznosek0@gmail.com> |
| |
| [ Upstream commit 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 ] |
| |
| If should_futex_fail() returns true in futex_wake_pi(), then the 'ret' |
| variable is set to -EFAULT and then immediately overwritten. So the failure |
| injection is non-functional. |
| |
| Fix it by actually leaving the function and returning -EFAULT. |
| |
| The Fixes tag is kinda blury because the initial commit which introduced |
| failure injection was already sloppy, but the below mentioned commit broke |
| it completely. |
| |
| [ tglx: Massaged changelog ] |
| |
| Fixes: 6b4f4bc9cb22 ("locking/futex: Allow low-level atomic operations to return -EAGAIN") |
| Signed-off-by: Mateusz Nosek <mateusznosek0@gmail.com> |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Link: https://lore.kernel.org/r/20200927000858.24219-1-mateusznosek0@gmail.com |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/futex.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| diff --git a/kernel/futex.c b/kernel/futex.c |
| index a5876694a60eb..39681bf8b06ca 100644 |
| --- a/kernel/futex.c |
| +++ b/kernel/futex.c |
| @@ -1502,8 +1502,10 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_pi_state *pi_ |
| */ |
| newval = FUTEX_WAITERS | task_pid_vnr(new_owner); |
| |
| - if (unlikely(should_fail_futex(true))) |
| + if (unlikely(should_fail_futex(true))) { |
| ret = -EFAULT; |
| + goto out_unlock; |
| + } |
| |
| ret = cmpxchg_futex_value_locked(&curval, uaddr, uval, newval); |
| if (!ret && (curval != uval)) { |
| -- |
| 2.27.0 |
| |
