[Devel] [PATCH RHEL7 COMMIT] ms/futex: Prevent attaching to kernel threads

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-123.1.2-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-123.1.2.vz7.5.17
------>
commit bcec2c2ed9079c734bd9a5fbe7ce6a4035ee94a5
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Wed Jun 24 16:32:33 2015 +0400

    ms/futex: Prevent attaching to kernel threads
    
    We happily allow userspace to declare a random kernel thread to be the
    owner of a user space PI futex.
    
    Found while analysing the fallout of Dave Jones syscall fuzzer.
    
    We also should validate the thread group for private futexes and find
    some fast way to validate whether the "alleged" owner has RW access on
    the file which backs the SHM, but that's a separate issue.
    
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Cc: Dave Jones <davej at redhat.com>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Darren Hart <darren at dvhart.com>
    Cc: Davidlohr Bueso <davidlohr at hp.com>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Clark Williams <williams at redhat.com>
    Cc: Paul McKenney <paulmck at linux.vnet.ibm.com>
    Cc: Lai Jiangshan <laijs at cn.fujitsu.com>
    Cc: Roland McGrath <roland at hack.frob.com>
    Cc: Carlos ODonell <carlos at redhat.com>
    Cc: Jakub Jelinek <jakub at redhat.com>
    Cc: Michael Kerrisk <mtk.manpages at gmail.com>
    Cc: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
    Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Cc: stable at vger.kernel.org
    (cherry picked from commit f0d71b3dcb8332f7971b5f2363632573e6d9486a)
    
    Ports diff-ms-futex-prevent-attaching-to-kernel-threads
    
    Related to https://jira.sw.ru/browse/PSBM-33650
    
    Signed-off-by: Vladimir Davydov <vdavydov at parallels.com>
---
 kernel/futex.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/futex.c b/kernel/futex.c
index 2d8b8b3..f9d7dba 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -788,6 +788,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 	if (!p)
 		return -ESRCH;
 
+	if (!p->mm) {
+		put_task_struct(p);
+		return -EPERM;
+	}
+
 	/*
 	 * We need to look at the task state flags to figure out,
 	 * whether the task is exiting. To protect against the do_exit