Oleg Nesterov 0ba239cc0e [PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445) ...

do_exit() clears ->it_##clock##_expires, but nothing prevents
another cpu to attach the timer to exiting process after that.
arm_timer() tries to protect against this race, but the check
is racy.

After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
before do_exit() calls 'schedule() local timer interrupt can find
tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
does sys_wait4) interrupted task has ->signal == NULL.

At this moment exiting task has no pending cpu timers, they were
cleanuped in __exit_signal()->posix_cpu_timers_exit{,_group}(),
so we can just return from irq.

John Stultz recently confirmed this bug, see

	http://marc.theaimsgroup.com/?l=linux-kernel&m=115015841413687

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>

2006-06-20 01:54:53 -07:00

..

irq

[PATCH] kernel/: small cleanups

2006-01-08 20:13:48 -08:00

power

[PATCH] Fix suspend with traced tasks

2006-04-17 13:16:06 -07:00

.gitignore

…

acct.c

[PATCH] move capable() to capability.h

2006-01-11 18:42:13 -08:00

audit.c

[PATCH] EDAC: atomic scrub operations

2006-01-18 19:20:30 -08:00

auditsc.c

[PATCH] make vm86 call audit_syscall_exit

2006-05-01 12:03:42 -07:00

capability.c

[PATCH] move capable() to capability.h

2006-01-11 18:42:13 -08:00

compat.c

[PATCH] remove bogus asm/bug.h includes.

2006-02-07 20:56:35 -05:00

configs.c

…

cpu.c

…

cpuset.c

[PATCH] cpuset: oops in exit on null cpuset fix

2006-02-15 15:32:21 -08:00

dma.c

…

exec_domain.c

[PATCH] Fix module refcount leak in __set_personality()

2006-04-07 09:44:29 -07:00

exit.c

[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)

2006-06-20 01:54:53 -07:00

extable.c

…

fork.c

[PATCH] wrong error path in dup_fd() leading to oopses in RCU

2006-04-07 09:44:28 -07:00

futex.c

[PATCH] FRV: Make futex code compilable on nommu [try #2]

2006-01-06 08:33:33 -08:00

hrtimer.c

[PATCH] fix next_timer_interrupt() for hrtimer

2006-03-06 18:40:44 -08:00

intermodule.c

[PATCH] missing license tag in intermodule

2006-02-05 11:06:52 -08:00

itimer.c

[PATCH] hrtimers: fix oldvalue return in setitimer

2006-02-01 08:53:12 -08:00

kallsyms.c

…

Kconfig.hz

…

Kconfig.preempt

…

kexec.c

[PATCH] move capable() to capability.h

2006-01-11 18:42:13 -08:00

kfifo.c

…

kmod.c

…

kprobes.c

[PATCH] Kprobes: Fix deadlock in function-return probes

2006-02-03 08:32:00 -08:00

ksysfs.c

[PATCH] kdump: export per cpu crash notes pointer through sysfs

2006-01-10 08:01:26 -08:00

kthread.c

…

Makefile

[PATCH] build kernel/intermodule.c only when required

2006-01-16 23:15:26 -08:00

module.c

[PATCH] module: strlen_user() race fix

2006-02-07 16:12:32 -08:00

mutex-debug.c

[PATCH] fix/simplify mutex debugging code

2006-01-11 08:14:16 -08:00

mutex-debug.h

[PATCH] mutex subsystem, debugging code

2006-01-09 15:59:20 -08:00

mutex.c

[PATCH] mutex: trivial whitespace cleanups

2006-01-10 14:27:59 -08:00

mutex.h

[PATCH] mutex subsystem, core

2006-01-09 15:59:19 -08:00

panic.c

[PATCH] prevent recursive panic from softlockup watchdog

2006-02-10 08:13:12 -08:00

params.c

…

pid.c

[PATCH] RCU signal handling

2006-01-08 20:13:40 -08:00

posix-cpu-timers.c

[PATCH] run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)

2006-06-20 01:54:53 -07:00

posix-timers.c

[PATCH] posix-timers: fix requeue accounting when signal is ignored

2006-03-17 07:51:25 -08:00

printk.c

correct email address of Manfred Spraul

2006-01-15 02:43:54 +01:00

profile.c

…

ptrace.c

[PATCH] ptrace_attach: fix possible deadlock schenario with irqs

2006-05-20 15:00:33 -07:00

rcupdate.c

[PATCH] rcu batch tuning

2006-03-08 14:14:01 -08:00

rcutorture.c

[PATCH] rcu_torture_lock deadlock fix

2006-01-31 11:30:18 -08:00

resource.c

[PATCH] kernel/resource.c: __check_region(): remove pointless __deprecated

2006-01-10 08:02:02 -08:00

sched.c

[PATCH] fix scheduler deadlock

2006-03-27 22:47:31 -08:00

seccomp.c

…

signal.c

[PATCH] fix non-leader exec under ptrace

2006-04-17 13:16:06 -07:00

softirq.c

…

softlockup.c

…

spinlock.c

…

stop_machine.c

[PATCH] Remove set_fs() in stop_machine()

2006-01-10 08:01:25 -08:00

sys_ni.c

[PATCH] Fix compile for CONFIG_SYSVIPC=n or CONFIG_SYSCTL=n

2006-02-20 20:00:11 -08:00

sys.c

[PATCH] RLIMIT_CPU: fix handling of a zero limit

2006-04-17 13:16:06 -07:00

sysctl.c

[PATCH] fix file counting

2006-03-08 14:14:01 -08:00

time.c

[PATCH] Normalize timespec for negative values in ns_to_timespec

2006-02-03 08:32:06 -08:00

timer.c

[PATCH] time_interpolator: add __read_mostly

2006-03-17 07:51:25 -08:00

uid16.c

[PATCH] Add more prevent_tail_call()

2006-04-24 09:56:05 -07:00

user.c

[PATCH] "Fix uidhash_lock <-> RXU deadlock" fix

2006-01-31 16:49:43 -08:00

wait.c

…

workqueue.c

[PATCH] Unlinline a bunch of other functions

2006-01-14 18:27:06 -08:00