[Devel] [PATCH RHEL7 COMMIT] ms/futex: Unlock hb->lock in futex_wait_requeue_pi() error path

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1127.10.1.vz7.162.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1127.10.1.vz7.162.3
------>
commit b94ea1a0e38be3530e9d487e238ade9902d93344
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Thu Sep 11 23:44:35 2014 +0200

    ms/futex: Unlock hb->lock in futex_wait_requeue_pi() error path
    
    futex_wait_requeue_pi() calls futex_wait_setup(). If
    futex_wait_setup() succeeds it returns with hb->lock held and
    preemption disabled. Now the sanity check after this does:
    
            if (match_futex(&q.key, &key2)) {
                    ret = -EINVAL;
                    goto out_put_keys;
            }
    
    which releases the keys but does not release hb->lock.
    
    So we happily return to user space with hb->lock held and therefor
    preemption disabled.
    
    Unlock hb->lock before taking the exit route.
    
    Reported-by: Dave "Trinity" Jones <davej at redhat.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Reviewed-by: Darren Hart <dvhart at linux.intel.com>
    Reviewed-by: Davidlohr Bueso <dave at stgolabs.net>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: stable at vger.kernel.org
    Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1409112318500.4178@nanos
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    
    https://jira.sw.ru/browse/PSBM-104664
    
    (cherry picked from commit 13c42c2f43b19aab3195f2d357db00d1e885eaa8)
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 kernel/futex.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/futex.c b/kernel/futex.c
index b03ba47b566e3..40d87d6402e73 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2633,6 +2633,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 	 * shared futexes. We need to compare the keys:
 	 */
 	if (match_futex(&q.key, &key2)) {
+		queue_unlock(hb);
 		ret = -EINVAL;
 		goto out_put_keys;
 	}