Subject: futex: Simplify fixup_pi_state_owner()
From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue Jan 19 16:26:38 2021 +0100
Git-commit: f2dac39d93987f7de1e20b3988c8685523247ae2
Patch-mainline: v5.11-rc6
References: bsc#1181349 bsc#1149032 CVE-2021-3347
Too many gotos already and an upcoming fix would make it even more
unreadable.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
---
kernel/futex.c | 53 ++++++++++++++++++++++++++---------------------------
1 file changed, 26 insertions(+), 27 deletions(-)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2463,18 +2463,13 @@ static void unqueue_me_pi(struct futex_q
spin_unlock(q->lock_ptr);
}
-static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
- struct task_struct *argowner)
+static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+ struct task_struct *argowner)
{
+ u32 uval, uninitialized_var(curval), newval, newtid;
struct futex_pi_state *pi_state = q->pi_state;
- u32 uval, uninitialized_var(curval), newval;
struct task_struct *oldowner, *newowner;
- u32 newtid;
- int ret, err = 0;
-
- lockdep_assert_held(q->lock_ptr);
-
- raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+ int err = 0;
oldowner = pi_state->owner;
@@ -2508,14 +2503,12 @@ static int fixup_pi_state_owner(u32 __us
* We raced against a concurrent self; things are
* already fixed up. Nothing to do.
*/
- ret = 0;
- goto out_unlock;
+ return 0;
}
if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) {
/* We got the lock. pi_state is correct. Tell caller. */
- ret = 1;
- goto out_unlock;
+ return 1;
}
/*
@@ -2542,8 +2535,7 @@ static int fixup_pi_state_owner(u32 __us
* We raced against a concurrent self; things are
* already fixed up. Nothing to do.
*/
- ret = 1;
- goto out_unlock;
+ return 1;
}
newowner = argowner;
}
@@ -2574,7 +2566,6 @@ static int fixup_pi_state_owner(u32 __us
* itself.
*/
pi_state_update_owner(pi_state, newowner);
- raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
return argowner == current;
@@ -2597,17 +2588,16 @@ static int fixup_pi_state_owner(u32 __us
switch (err) {
case -EFAULT:
- ret = fault_in_user_writeable(uaddr);
+ err = fault_in_user_writeable(uaddr);
break;
case -EAGAIN:
cond_resched();
- ret = 0;
+ err = 0;
break;
default:
WARN_ON_ONCE(1);
- ret = err;
break;
}
@@ -2617,17 +2607,26 @@ static int fixup_pi_state_owner(u32 __us
/*
* Check if someone else fixed it for us:
*/
- if (pi_state->owner != oldowner) {
- ret = argowner == current;
- goto out_unlock;
- }
+ if (pi_state->owner != oldowner)
+ return argowner == current;
- if (ret)
- goto out_unlock;
+ /* Retry if err was -EAGAIN or the fault in succeeded */
+ if (!err)
+ goto retry;
- goto retry;
+ return err;
+}
-out_unlock:
+static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
+ struct task_struct *argowner)
+{
+ struct futex_pi_state *pi_state = q->pi_state;
+ int ret;
+
+ lockdep_assert_held(q->lock_ptr);
+
+ raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
+ ret = __fixup_pi_state_owner(uaddr, q, argowner);
raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
return ret;
}