Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 137623 - Kernel: run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)
Summary: Kernel: run_posix_cpu_timers: remove a bogus BUG_ON() (CVE-2006-2445)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://www.kernel.org/git/?p=linux/ke...
Whiteboard: [linux <2.6.16.21]
Keywords:
Depends on:
Blocks:
 
Reported: 2006-06-22 11:01 UTC by Sune Kloppenborg Jeppesen (RETIRED)
Modified: 2009-07-29 20:31 UTC (History)
7 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-06-22 11:01:01 UTC 
do_exit() clears ->it_##clock##_expires, but nothing prevents
 another cpu to attach the timer to exiting process after that.
 arm_timer() tries to protect against this race, but the check
 is racy.
 
 After exit_notify() does 'write_unlock_irq(&tasklist_lock)' and
 before do_exit() calls 'schedule() local timer interrupt can find
 tsk->exit_state != 0. If that state was EXIT_DEAD (or another cpu
 does sys_wait4) interrupted task has ->signal == NULL.
 
 At this moment exiting task has no pending cpu timers, they were
 cleanuped in __exit_signal()->posix_cpu_timers_exit{,_group}(),
 so we can just return from irq.
 
 John Stultz recently confirmed this bug, see
 
 http://marc.theaimsgroup.com/?l=linux-kernel&m=115015841413687
Comment 2 Tim Yamin (RETIRED) gentoo-dev 2006-06-24 13:09:14 UTC 
dsd: Please add to genpatches-2.6.16.
Comment 3 Daniel Drake (RETIRED) gentoo-dev 2006-07-01 04:51:42 UTC 
Fixed in gentoo-sources-2.6.16-r11 / genpatches-2.6.16-23
Comment 4 Tim Yamin (RETIRED) gentoo-dev 2006-07-02 08:36:37 UTC 
Maintainers please bump to 2.6.16.23 preferably or genpatches-2.6.16-13; does not affect 2.6.17:

ck-sources-2.6.16: marineam
hardened-sources-2.6: johnm, hardened
mips-sources-2.6.16: `Kumba
rsbac-sources-2.6: kang
sh-sources-2.6: vapier
suspend2-sources-2.6: brix
usermode-sources-2.6: dang
xbox-sources-2.6: chrb, gimli
xen-sources-2.6: chrb, agriffis
Comment 5 Daniel Gryniewicz (RETIRED) gentoo-dev 2006-07-03 11:03:03 UTC 
usermode-sources done.
Comment 6 Henrik Brix Andersen 2006-07-04 11:05:31 UTC 
Fixed in sys-kernel/suspend2-sources-2.6.16-r10.
Comment 7 Micheal Marineau (RETIRED) gentoo-dev 2006-07-09 16:36:40 UTC 
Fixed in ck-sources-2.6.16_p12-r1.
Comment 8 Tim Yamin (RETIRED) gentoo-dev 2006-08-07 13:50:50 UTC 
All fixed, closing bug. rsbac-sources masked.