Thomas Gleixner
8ad6679a5b
posix-timers: Ensure timer ID search-loop limit is valid ...
[ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ]
posix_timer_add() tries to allocate a posix timer ID by starting from the
cached ID which was stored by the last successful allocation.
This is done in a loop searching the ID space for a free slot one by
one. The loop has to terminate when the search wrapped around to the
starting point.
But that's racy vs. establishing the starting point. That is read out
lockless, which leads to the following problem:
CPU0 CPU1
posix_timer_add()
start = sig->posix_timer_id;
lock(hash_lock);
... posix_timer_add()
if (++sig->posix_timer_id < 0)
start = sig->posix_timer_id;
sig->posix_timer_id = 0;
So CPU1 can observe a negative start value, i.e. -1, and the loop break
never happens because the condition can never be true:
if (sig->posix_timer_id == start)
break;
While this is unlikely to ever turn into an endless loop as the ID space is
huge (INT_MAX), the racy read of the start value caught the attention of
KCSAN and Dmitry unearthed that incorrectness.
Rewrite it so that all id operations are under the hash lock.
Reported-by: syzbot+5c54bd3eb218bb595aa9@syzkaller.appspotmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/r/87bkhzdn6g.ffs@tglx
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:37:42 +02:00
can: sja1000: fix size of OCR_MODE_MASK define
2022-12-19 12:24:16 +01:00
iio: st_sensors: Add a local lock for protecting odr
2022-06-14 18:11:59 +02:00
mailbox: zynqmp: Fix typo in IPI documentation
2023-05-17 11:35:55 +02:00
net: xgene: Move shared header file into include/linux
2023-02-06 07:52:47 +01:00
mfd: t7l66xb: Drop platform disable callback
2022-08-25 11:18:04 +02:00
net/mlx5: Fix possible use-after-free in async command interface
2022-11-03 23:56:56 +09:00
mmc: core: Fix ambiguous TRIM and DISCARD arg
2022-12-08 11:23:04 +01:00
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
2022-06-14 18:12:03 +02:00
netfilter: add helper function to set up the nfnetlink header and use it
2023-07-27 08:37:27 +02:00
netfilter: ebtables: reject blobs that don't provide all entry points
2022-09-05 10:27:41 +02:00
platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask
2022-09-15 12:04:50 +02:00
power: supply: bq27xxx: Fix poll_interval handling and races on remove
2023-05-30 12:44:10 +01:00
posix-timers: Ensure timer ID search-loop limit is valid
2023-07-27 08:37:42 +02:00
SUNRPC: remove the maximum number of retries in call_bind_status
2023-05-17 11:35:52 +02:00
usb: usbfs: Enforce page requirements for mmap
2023-06-14 10:59:58 +02:00
arm64: entry: Add vectors that have the bhb mitigation sequences
2022-03-19 13:40:15 +01:00
ata: fix ata_id_has_dipm()
2022-10-26 13:22:39 +02:00
bitfield.h: Fix "type of reg too small for mask" test
2022-07-29 17:14:18 +02:00
ocfs2/dlm: move BITS_TO_BYTES() to bitops.h for wider use
2023-06-09 10:28:54 +02:00
block: don't merge across cgroup boundaries if blkcg is enabled
2022-04-15 14:18:01 +02:00
block: return ELEVATOR_DISCARD_MERGE if possible
2022-05-25 09:14:38 +02:00
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
2022-06-14 18:11:34 +02:00
fs: only do a memory barrier for the first set_buffer_uptodate()
2022-09-15 12:04:49 +02:00
cgroup: Use separate src/dst nodes when preloading css_sets for migration
2022-07-21 20:59:17 +02:00
memcg: fix possible use-after-free in memcg_write_event_control()
2022-12-14 11:30:43 +01:00
clk: Provide new devm_clk helpers for prepared and enabled clocks
2023-02-06 07:52:34 +01:00
x86/bugs: Report AMD retbleed vulnerability
2022-10-07 09:16:54 +02:00
firmware: arm_sdei: Fix sleep from invalid context BUG
2023-05-30 12:44:02 +01:00
debugfs: regset32: Add Runtime PM support
2023-05-17 11:35:32 +02:00
PM/devfreq: governor: Add a private governor_data for governor
2023-01-18 11:41:52 +01:00
dm: remove special-casing of bio-based immutable singleton target on NVMe
2022-06-25 12:44:35 +02:00
driver core: add a helper to setup both the of_node and fwnode of a device
2023-05-30 12:44:01 +01:00
linux/dim: Do nothing if no time delta between samples
2023-05-30 12:44:01 +01:00
dma-mapping: add generic helpers for mapping sgtable objects
2023-02-25 11:53:25 +01:00
dma-mapping: drop the dev argument to arch_sync_dma_for_*
2023-04-05 11:16:43 +02:00
dyndbg: fix module.dyndbg handling
2022-10-26 13:22:37 +02:00
efi: random: reduce seed size to 32 bytes
2022-11-10 17:57:55 +01:00
net: create netdev->dev_addr assignment helpers
2023-07-27 08:37:08 +02:00
eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
2023-01-18 11:40:58 +01:00
fbcon: Prevent that screen size is smaller than font size
2022-07-12 16:30:47 +02:00
fs: fix undefined behavior in bit shift for SB_NOUSER
2023-06-05 08:17:32 +02:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
ftrace: Mark get_lock_parent_ip() __always_inline
2023-04-20 12:07:34 +02:00
HID: core: Provide new max_buffer_size attribute to over-ride the default
2023-03-22 13:28:10 +01:00
mm/highmem: Lift memcpy_[to|from]_page to core
2023-01-18 11:41:55 +01:00
hugetlb: check for undefined shift on 32 bit architectures
2023-02-22 12:50:39 +01:00
random: pull add_hwgenerator_randomness() declaration into random.h
2022-06-22 14:11:12 +02:00
net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
2022-03-23 09:12:07 +01:00
net: fix stack overflow when LRO is disabled for virtual interfaces
2023-05-30 12:44:09 +01:00
net: add vlan_get_protocol_and_depth() helper
2023-05-30 12:44:01 +01:00
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
2023-03-11 16:44:02 +01:00
genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
2023-05-17 11:35:46 +02:00
iomap: iomap that extends beyond EOF should be marked dirty
2022-09-28 11:03:58 +02:00
iommu: Add gfp parameter to iommu_ops::map
2023-02-22 12:50:31 +01:00
iommu/iova: Fix module config properly
2022-10-26 13:22:46 +02:00
shm: extend forced shm destroy to support objects from several IPC nses
2021-12-01 09:23:35 +01:00
ipv6: make mc_forwarding atomic
2022-04-15 14:18:32 +02:00
irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent
2023-03-17 08:32:49 +01:00
panic: Consolidate open-coded panic_on_warn checks
2023-02-06 07:52:50 +01:00
genirq: Fix the return type of kstat_cpu_irqs_sum()
2023-03-11 16:43:38 +01:00
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:28:50 +02:00
kfifo: fix kfifo_to_user() return type
2022-08-25 11:18:04 +02:00
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
2023-03-11 16:44:02 +01:00
x86/kvm/vmx: Make noinstr clean
2022-10-07 09:16:54 +02:00
list: add "list_del_init_careful()" to go with "list_empty_careful()"
2023-06-28 10:18:35 +02:00
mailbox: forward the hrtimer if not queued and under a lock
2022-06-14 18:11:42 +02:00
ext4: fix deadlock due to mbcache entry corruption
2023-01-18 11:41:56 +01:00
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
2022-05-25 09:14:32 +02:00
memblock: fix memblock_phys_alloc() section mismatch error
2022-01-05 12:37:44 +01:00
mmap locking API: initial implementation as rwsem wrappers
2022-07-29 17:14:18 +02:00
mmap locking API: initial implementation as rwsem wrappers
2022-07-29 17:14:18 +02:00
mm: Fix '.data.once' orphan section warning
2022-12-08 11:23:04 +01:00
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
2022-05-15 19:54:46 +02:00
x86/cpu: Add a steppings field to struct x86_cpu_id
2022-10-07 09:16:54 +02:00
net: Fix features skip in for_each_netdev_feature()
2022-05-18 09:47:24 +02:00
net: create netdev->dev_addr assignment helpers
2023-07-27 08:37:08 +02:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
Remove DECnet support from kernel
2023-06-21 15:44:10 +02:00
NFS: swap IO handling is slightly different for O_DIRECT IO
2022-04-15 14:18:35 +02:00
watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
2023-07-27 08:37:10 +02:00
nodemask: Fix return values to be unsigned
2022-06-14 18:12:02 +02:00
uaccess: Add speculation barrier to copy_from_user()
2023-02-25 11:53:26 +01:00
nvme-tcp: fix nvme_tcp_term_pdu to match spec
2023-04-05 11:16:38 +02:00
nvme: handle the persistent internal error AER
2023-05-17 11:35:43 +02:00
of: clk: Make <linux/of_clk.h> self-contained
2021-12-08 09:01:08 +01:00
once: fix section mismatch on clang builds
2022-11-01 19:06:42 +01:00
PCI: Add pci_clear_master() stub for non-CONFIG_PCI
2023-07-27 08:37:16 +02:00
PCI: Add SolidRun vendor ID
2023-03-17 08:32:52 +01:00
perf: Protect perf_guest_cbs with RCU
2022-01-20 09:19:18 +01:00
PM: domains: Restore comment indentation for generic_pm_domain.child_links
2023-05-17 11:36:04 +02:00
power: supply: core: Refactor power_supply_set_input_current_limit_from_supplier()
2023-06-05 08:17:31 +02:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
2023-05-17 11:36:04 +02:00
net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
2023-01-18 11:41:02 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
2022-06-14 18:11:24 +02:00
quota: Factor out setup of quota inode
2023-01-18 11:42:02 +01:00
random: always mix cycle counter in add_latent_entropy()
2023-02-25 11:53:25 +01:00
random: quiet urandom warning ratelimit suppression message
2022-06-29 08:58:45 +02:00
rcu: Upgrade rcu_swap_protected() to rcu_replace_pointer()
2023-06-28 10:18:38 +02:00
locking/refcount: Consolidate implementations of refcount_t
2022-07-29 17:14:17 +02:00
tracing/ring-buffer: Have polling block on watermark
2022-12-08 11:23:05 +01:00
mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
2022-09-05 10:27:46 +02:00
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
2021-11-17 09:48:44 +01:00
misc: rtsx_usb: use separate command and response buffers
2022-07-12 16:30:49 +02:00
scatterlist: add generic wrappers for iterating over sgtable objects
2023-02-25 11:53:25 +01:00
kernel/sched: Remove dl_boosted flag comment
2022-09-05 10:27:39 +02:00
lockdown: also lock down previous kgdb use
2022-06-06 08:33:48 +02:00
Revert "8250: add support for ASIX devices with a FIFO bug"
2023-07-27 08:37:38 +02:00
serial: Create uart_xmit_advance()
2022-09-28 11:04:08 +02:00
sh: intc: Avoid spurious sizeof-pointer-div warning
2023-03-22 13:28:08 +01:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
netfilter: nf_tables: fix ifdef to also consider nf_tables=m
2023-04-26 11:24:02 +02:00
net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
2023-02-22 12:50:34 +01:00
lib/string_helpers: Introduce string_upper() and string_lower() helpers
2023-05-30 12:44:08 +01:00
PM: s2idle: ACPI: Fix wakeup interrupts handling
2022-02-16 12:52:50 +01:00
sysctl: add a new register_sysctl_init() interface
2023-02-06 07:52:48 +01:00
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
2022-10-26 13:22:26 +02:00
tee: export teedev_open() and teedev_close_context()
2022-03-02 11:41:04 +01:00
tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
2023-05-17 11:35:57 +02:00
timerqueue: Use rb_entry_safe() in timerqueue_getnext()
2023-01-18 11:40:53 +01:00
timekeeping: Add raw clock fallback for random_get_entropy()
2022-06-22 14:11:15 +02:00
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
2022-03-08 19:07:48 +01:00
efi: tpm: Avoid READ_ONCE() for accessing the event log
2023-01-18 11:42:00 +01:00
tracing: Make tracepoint lockdep check actually test something
2023-03-22 13:28:08 +01:00
tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
2023-05-17 11:36:04 +02:00
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
2022-07-29 17:14:20 +02:00
uaccess: Add minimum bounds check on kernel buffer size
2023-03-11 16:43:56 +01:00
USB: core: Add routines for endpoint checks in old drivers
2023-05-30 12:44:10 +01:00
virtio: unexport virtio_finalize_features
2022-03-16 13:21:48 +01:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
net: skip virtio_net_hdr_set_proto if protocol already set
2021-12-29 12:23:34 +01:00
linux/vt_buffer.h: allow either builtin or modular for macros
2023-05-17 11:35:46 +02:00
wait: Fix __wait_event_hrtimeout for RT/DL tasks
2022-08-25 11:17:29 +02:00
workqueue: clean up WORK_* constant types, clarify masking
2023-07-27 08:37:29 +02:00
