summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorWill Deacon <will.deacon@arm.com>2019-04-08 13:45:09 +0200
committerWill Deacon <will.deacon@arm.com>2019-04-26 14:57:04 +0200
commit84ff7a09c371bc7417eabfda19bf7f113ec917b6 (patch)
tree9deec03c8b9a65e83204fa2b5bd1d481d3791f60 /kernel
parentLinux 5.1-rc3 (diff)
downloadlinux-84ff7a09c371bc7417eabfda19bf7f113ec917b6.tar.xz
linux-84ff7a09c371bc7417eabfda19bf7f113ec917b6.zip
arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
Rather embarrassingly, our futex() FUTEX_WAKE_OP implementation doesn't explicitly set the return value on the non-faulting path and instead leaves it holding the result of the underlying atomic operation. This means that any FUTEX_WAKE_OP atomic operation which computes a non-zero value will be reported as having failed. Regrettably, I wrote the buggy code back in 2011 and it was upstreamed as part of the initial arm64 support in 2012. The reasons we appear to get away with this are: 1. FUTEX_WAKE_OP is rarely used and therefore doesn't appear to get exercised by futex() test applications 2. If the result of the atomic operation is zero, the system call behaves correctly 3. Prior to version 2.25, the only operation used by GLIBC set the futex to zero, and therefore worked as expected. From 2.25 onwards, FUTEX_WAKE_OP is not used by GLIBC at all. Fix the implementation by ensuring that the return value is either 0 to indicate that the atomic operation completed successfully, or -EFAULT if we encountered a fault when accessing the user mapping. Cc: <stable@kernel.org> Fixes: 6170a97460db ("arm64: Atomic operations") Signed-off-by: Will Deacon <will.deacon@arm.com>
Diffstat (limited to 'kernel')
0 files changed, 0 insertions, 0 deletions