arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value
authorWill Deacon <will.deacon@arm.com>
Mon, 8 Apr 2019 11:45:09 +0000 (12:45 +0100)
committerWill Deacon <will.deacon@arm.com>
Fri, 12 Apr 2019 14:04:33 +0000 (15:04 +0100)
commit045afc24124d80c6998d9c770844c67912083506
tree8e02bd1946e0704bff6f2e96ec758eb8f61b60cc
parent1e6f5440a6814d28c32d347f338bfef68bc3e69d
arm64: futex: Fix FUTEX_WAKE_OP atomic ops with non-zero result value

Rather embarrassingly, our futex() FUTEX_WAKE_OP implementation doesn't
explicitly set the return value on the non-faulting path and instead
leaves it holding the result of the underlying atomic operation. This
means that any FUTEX_WAKE_OP atomic operation which computes a non-zero
value will be reported as having failed. Regrettably, I wrote the buggy
code back in 2011 and it was upstreamed as part of the initial arm64
support in 2012.

The reasons we appear to get away with this are:

  1. FUTEX_WAKE_OP is rarely used and therefore doesn't appear to get
     exercised by futex() test applications

  2. If the result of the atomic operation is zero, the system call
     behaves correctly

  3. Prior to version 2.25, the only operation used by GLIBC set the
     futex to zero, and therefore worked as expected. From 2.25 onwards,
     FUTEX_WAKE_OP is not used by GLIBC at all.

Fix the implementation by ensuring that the return value is either 0
to indicate that the atomic operation completed successfully, or -EFAULT
if we encountered a fault when accessing the user mapping.

Cc: <stable@kernel.org>
Fixes: 6170a97460db ("arm64: Atomic operations")
Signed-off-by: Will Deacon <will.deacon@arm.com>
arch/arm64/include/asm/futex.h