Thomas Gleixner
b3eaa9fc5c
futex: Validate atomic acquisition in futex_lock_pi_atomic()
...
We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.
Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.
[ tglx: Use futex_top_waiter() and explain why we do not need to try
restoring the already corrupted user space state. ]
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2014-06-05 12:31:07 -07:00
..
debug
mm: per-thread vma caching
2014-04-07 16:35:53 -07:00
events
perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()
2014-05-19 21:44:56 +09:00
gcov
irq
genirq: x86: Ensure that dynamic irq allocation does not conflict
2014-04-28 12:20:00 +02:00
locking
rtmutex: Fix deadlock detector for real
2014-05-28 17:28:13 +02:00
power
asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*
2014-05-05 16:07:46 -07:00
printk
asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*
2014-05-05 16:07:46 -07:00
rcu
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 11:21:19 -07:00
sched
Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-06-01 18:26:59 -07:00
time
tick-sched: Check tick_nohz_enabled in tick_nohz_switch_to_nohz()
2014-04-15 20:26:58 +02:00
trace
tracing: Use rcu_dereference_sched() for trace event triggers
2014-05-02 23:12:42 -04:00
.gitignore
Ignore generated file kernel/x509_certificate_list
2013-12-10 18:21:34 +00:00
acct.c
async.c
audit.c
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
audit.h
audit: Use struct net not pid_t to remember the network namespce to reply in
2014-03-20 10:10:53 -04:00
audit_tree.c
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
audit_watch.c
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
auditfilter.c
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
auditsc.c
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
backtracetest.c
bounds.c
mm: do not allocate page->ptl dynamically, if spinlock_t fits to long
2013-12-20 12:25:45 -08:00
capability.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2014-04-03 09:26:18 -07:00
cgroup.c
cgroup: introduce task_css_is_root()
2014-05-13 11:26:27 -04:00
cgroup_freezer.c
cgroup: fix rcu_read_lock() leak in update_if_frozen()
2014-05-13 11:28:30 -04:00
compat.c
Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-02 12:51:41 -07:00
configs.c
context_tracking.c
asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*
2014-05-05 16:07:46 -07:00
cpu.c
sched: Fix hotplug vs. set_cpus_allowed_ptr()
2014-05-22 10:21:31 +02:00
cpu_pm.c
cpuset.c
Merge branch 'akpm' (incoming from Andrew)
2014-04-03 16:22:16 -07:00
crash_dump.c
cred.c
delayacct.c
dma.c
elfcore.c
exec_domain.c
exit.c
wait: WSTOPPED|WCONTINUED doesn't work if a zombie leader is traced by another process
2014-04-07 16:36:06 -07:00
extable.c
asmlinkage: Make main_extable_sort_needed visible
2014-02-13 18:13:22 -08:00
fork.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
freezer.c
libata, freezer: avoid block device removal while system is frozen
2013-12-19 13:50:32 -05:00
futex.c
futex: Validate atomic acquisition in futex_lock_pi_atomic()
2014-06-05 12:31:07 -07:00
futex_compat.c
compat: Get rid of (get|put)_compat_time(val|spec)
2014-02-02 14:09:12 -08:00
groups.c
kernel/groups.c: remove return value of set_groups
2014-04-03 16:21:05 -07:00
hrtimer.c
hrtimer: Set expiry time before switch_hrtimer_base()
2014-05-12 10:47:39 +02:00
hung_task.c
kernel: audit/fix non-modular users of module_init in core code
2014-04-03 16:21:07 -07:00
irq_work.c
perf/x86: Warn to early_printk() in case irq_work is too slow
2014-02-21 21:49:07 +01:00
itimer.c
jump_label.c
kallsyms.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kexec.c
powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode
2014-05-28 13:24:26 +10:00
kmod.c
execve: use 'struct filename *' for executable name passing
2014-02-05 12:54:53 -08:00
kprobes.c
ksysfs.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kthread.c
kthread: ensure locality of task_struct allocations
2014-04-03 16:20:49 -07:00
latencytop.c
Makefile
Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 14:13:25 -07:00
module-internal.h
module.c
Fixed one missing place for the new taint flag, and remove a warning
2014-05-01 10:35:01 -07:00
module_signing.c
notifier.c
notifier: Substitute rcu_access_pointer() for rcu_dereference_raw()
2014-02-26 06:35:13 -08:00
nsproxy.c
padata.c
padata: Fix wrong usage of rcu_dereference()
2013-12-05 21:28:42 +08:00
panic.c
kernel/panic.c: display reason at end + pr_emerg
2014-04-07 16:36:08 -07:00
params.c
params: improve standard definitions
2013-12-04 14:09:46 +10:30
pid.c
pid_namespace.c
pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
2014-04-02 16:20:21 -07:00
posix-cpu-timers.c
posix-timers: Convert abuses of BUG_ON to WARN_ON
2013-12-09 16:56:29 +01:00
posix-timers.c
profile.c
CPU hotplug notifiers registration fixes for 3.15-rc1
2014-04-07 14:55:46 -07:00
ptrace.c
kernel/compat: convert to COMPAT_SYSCALL_DEFINE
2014-03-06 15:35:10 +01:00
range.c
reboot.c
kexec: migrate to reboot cpu
2013-12-18 19:04:50 -08:00
relay.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-04-12 14:49:50 -07:00
res_counter.c
res_counter: remove interface for locked charging and uncharging
2014-04-07 16:35:54 -07:00
resource.c
kernel/resource.c: make reallocate_resource() static
2014-04-03 16:21:07 -07:00
seccomp.c
seccomp: fix memory leak on filter attach
2014-04-16 15:25:53 -04:00
signal.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
smp.c
smp: Rename __smp_call_function_single() to smp_call_function_single_async()
2014-02-24 14:47:15 -08:00
smpboot.c
smpboot.h
softirq.c
asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*
2014-05-05 16:07:46 -07:00
stacktrace.c
stop_machine.c
stop_machine: Fix^2 race between stop_two_cpus() and stop_cpus()
2014-03-11 11:33:47 +01:00
sys.c
mm, thp: add VM_INIT_DEF_MASK and PRCTL_THP_DISABLE
2014-04-07 16:35:52 -07:00
sys_ni.c
fs, kernel: permit disabling the uselib syscall
2014-04-03 16:21:05 -07:00
sysctl.c
hung_task: check the value of "sysctl_hung_task_timeout_sec"
2014-04-07 16:36:07 -07:00
sysctl_binary.c
system_certificates.S
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
system_keyring.c
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
task_work.c
taskstats.c
test_kprobes.c
time.c
timeconst.bc
timer.c
timer: Prevent overflow in apply_slack
2014-04-30 13:46:17 +02:00
torture.c
rcutorture: Gracefully handle NULL cleanup hooks
2014-02-23 09:04:39 -08:00
tracepoint.c
tracepoint: Fix use of tracepoint funcs after rcu free
2014-05-08 09:10:56 -04:00
tsacct.c
uid16.c
up.c
smp: Rename __smp_call_function_single() to smp_call_function_single_async()
2014-02-24 14:47:15 -08:00
user-return-notifier.c
user.c
kernel: audit/fix non-modular users of module_init in core code
2014-04-03 16:21:07 -07:00
user_namespace.c
user namespace: fix incorrect memory barriers
2014-04-14 16:03:02 -07:00
utsname.c
utsname_sysctl.c
watchdog.c
kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()
2014-04-18 16:40:08 -07:00
workqueue.c
workqueue: fix a possible race condition between rescuer and pwq-release
2014-04-18 12:33:29 -04:00
workqueue_internal.h