Thomas Gleixner b3eaa9fc5c futex: Validate atomic acquisition in futex_lock_pi_atomic() ... We need to protect the atomic acquisition in the kernel against rogue user space which sets the user space futex to 0, so the kernel side acquisition succeeds while there is existing state in the kernel associated to the real owner. Verify whether the futex has waiters associated with kernel state. If it has, return -EINVAL. The state is corrupted already, so no point in cleaning it up. Subsequent calls will fail as well. Not our problem. [ tglx: Use futex_top_waiter() and explain why we do not need to try restoring the already corrupted user space state. ] Signed-off-by: Darren Hart <dvhart@linux.intel.com> Cc: Kees Cook <keescook@chromium.org> Cc: Will Drewry <wad@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-06-05 12:31:07 -07:00
..
debug	mm: per-thread vma caching	2014-04-07 16:35:53 -07:00
events	perf: Fix a race between ring_buffer_detach() and ring_buffer_attach()	2014-05-19 21:44:56 +09:00
gcov	gcov: reuse kbasename helper	2013-11-13 12:09:34 +09:00
irq	genirq: x86: Ensure that dynamic irq allocation does not conflict	2014-04-28 12:20:00 +02:00
locking	rtmutex: Fix deadlock detector for real	2014-05-28 17:28:13 +02:00
power	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
printk	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
rcu	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-03-31 11:21:19 -07:00
sched	Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-06-01 18:26:59 -07:00
time	tick-sched: Check tick_nohz_enabled in tick_nohz_switch_to_nohz()	2014-04-15 20:26:58 +02:00
trace	tracing: Use rcu_dereference_sched() for trace event triggers	2014-05-02 23:12:42 -04:00
.gitignore	Ignore generated file kernel/x509_certificate_list	2013-12-10 18:21:34 +00:00
Kconfig.freezer	…
Kconfig.hz	kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS	2013-11-15 09:32:22 +09:00
Kconfig.locks	locking: Fix copy/paste errors of "ARCH_INLINE_*_UNLOCK_BH"	2013-05-28 08:50:00 +02:00
Kconfig.preempt	…
Makefile	Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-03-31 14:13:25 -07:00
acct.c	…
async.c	…
audit.c	net: Use netlink_ns_capable to verify the permisions of netlink messages	2014-04-24 13:44:54 -04:00
audit.h	audit: Use struct net not pid_t to remember the network namespce to reply in	2014-03-20 10:10:53 -04:00
audit_tree.c	inotify: Fix reporting of cookies for inotify events	2014-02-18 11:17:17 +01:00
audit_watch.c	inotify: Fix reporting of cookies for inotify events	2014-02-18 11:17:17 +01:00
auditfilter.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
auditsc.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
backtracetest.c	…
bounds.c	mm: do not allocate page->ptl dynamically, if spinlock_t fits to long	2013-12-20 12:25:45 -08:00
capability.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2014-04-03 09:26:18 -07:00
cgroup.c	cgroup: introduce task_css_is_root()	2014-05-13 11:26:27 -04:00
cgroup_freezer.c	cgroup: fix rcu_read_lock() leak in update_if_frozen()	2014-05-13 11:28:30 -04:00
compat.c	Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-04-02 12:51:41 -07:00
configs.c	…
context_tracking.c	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
cpu.c	sched: Fix hotplug vs. set_cpus_allowed_ptr()	2014-05-22 10:21:31 +02:00
cpu_pm.c	…
cpuset.c	Merge branch 'akpm' (incoming from Andrew)	2014-04-03 16:22:16 -07:00
crash_dump.c	…
cred.c	…
delayacct.c	kernel/delayacct.c: remove redundant checking in __delayacct_add_tsk()	2013-11-13 12:09:12 +09:00
dma.c	…
elfcore.c	switch elf_core_write_extra_phdrs() to dump_emit()	2013-11-09 00:16:23 -05:00
exec_domain.c	…
exit.c	wait: WSTOPPED|WCONTINUED doesn't work if a zombie leader is traced by another process	2014-04-07 16:36:06 -07:00
extable.c	asmlinkage: Make main_extable_sort_needed visible	2014-02-13 18:13:22 -08:00
fork.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
freezer.c	libata, freezer: avoid block device removal while system is frozen	2013-12-19 13:50:32 -05:00
futex.c	futex: Validate atomic acquisition in futex_lock_pi_atomic()	2014-06-05 12:31:07 -07:00
futex_compat.c	compat: Get rid of (get|put)_compat_time(val|spec)	2014-02-02 14:09:12 -08:00
groups.c	kernel/groups.c: remove return value of set_groups	2014-04-03 16:21:05 -07:00
hrtimer.c	hrtimer: Set expiry time before switch_hrtimer_base()	2014-05-12 10:47:39 +02:00
hung_task.c	kernel: audit/fix non-modular users of module_init in core code	2014-04-03 16:21:07 -07:00
irq_work.c	perf/x86: Warn to early_printk() in case irq_work is too slow	2014-02-21 21:49:07 +01:00
itimer.c	…
jump_label.c	static_key: WARN on usage before jump_label_init was called	2013-10-19 19:45:35 -04:00
kallsyms.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
kcmp.c	…
kexec.c	powerpc, kexec: Fix "Processor X is stuck" issue during kexec from ST mode	2014-05-28 13:24:26 +10:00
kmod.c	execve: use 'struct filename *' for executable name passing	2014-02-05 12:54:53 -08:00
kprobes.c	kprobes: use KSYM_NAME_LEN to size identifier buffers	2013-11-13 12:09:26 +09:00
ksysfs.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
kthread.c	kthread: ensure locality of task_struct allocations	2014-04-03 16:20:49 -07:00
latencytop.c	…
module-internal.h	KEYS: Separate the kernel signature checking keyring from module signing	2013-09-25 17:17:01 +01:00
module.c	Fixed one missing place for the new taint flag, and remove a warning	2014-05-01 10:35:01 -07:00
module_signing.c	keys: change asymmetric keys to use common hash definitions	2013-10-25 17:15:18 -04:00
notifier.c	notifier: Substitute rcu_access_pointer() for rcu_dereference_raw()	2014-02-26 06:35:13 -08:00
nsproxy.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2013-09-07 14:35:32 -07:00
padata.c	padata: Fix wrong usage of rcu_dereference()	2013-12-05 21:28:42 +08:00
panic.c	kernel/panic.c: display reason at end + pr_emerg	2014-04-07 16:36:08 -07:00
params.c	params: improve standard definitions	2013-12-04 14:09:46 +10:30
pid.c	pidns: fix free_pid() to handle the first fork failure	2013-09-30 14:31:03 -07:00
pid_namespace.c	pid_namespace: pidns_get() should check task_active_pid_ns() != NULL	2014-04-02 16:20:21 -07:00
posix-cpu-timers.c	posix-timers: Convert abuses of BUG_ON to WARN_ON	2013-12-09 16:56:29 +01:00
posix-timers.c	…
profile.c	CPU hotplug notifiers registration fixes for 3.15-rc1	2014-04-07 14:55:46 -07:00
ptrace.c	kernel/compat: convert to COMPAT_SYSCALL_DEFINE	2014-03-06 15:35:10 +01:00
range.c	range: Do not add new blank slot with add_range_with_merge	2013-06-18 11:32:10 -05:00
reboot.c	kexec: migrate to reboot cpu	2013-12-18 19:04:50 -08:00
relay.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-04-12 14:49:50 -07:00
res_counter.c	res_counter: remove interface for locked charging and uncharging	2014-04-07 16:35:54 -07:00
resource.c	kernel/resource.c: make reallocate_resource() static	2014-04-03 16:21:07 -07:00
seccomp.c	seccomp: fix memory leak on filter attach	2014-04-16 15:25:53 -04:00
signal.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
smp.c	smp: Rename __smp_call_function_single() to smp_call_function_single_async()	2014-02-24 14:47:15 -08:00
smpboot.c	kernel: delete __cpuinit usage from all core kernel files	2013-07-14 19:36:59 -04:00
smpboot.h	…
softirq.c	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
stacktrace.c	…
stop_machine.c	stop_machine: Fix^2 race between stop_two_cpus() and stop_cpus()	2014-03-11 11:33:47 +01:00
sys.c	mm, thp: add VM_INIT_DEF_MASK and PRCTL_THP_DISABLE	2014-04-07 16:35:52 -07:00
sys_ni.c	fs, kernel: permit disabling the uselib syscall	2014-04-03 16:21:05 -07:00
sysctl.c	hung_task: check the value of "sysctl_hung_task_timeout_sec"	2014-04-07 16:36:07 -07:00
sysctl_binary.c	kernel/sysctl_binary.c: use scnprintf() instead of snprintf()	2013-11-13 12:09:33 +09:00
system_certificates.S	KEYS: correct alignment of system_certificate_list content in assembly file	2013-12-10 18:25:28 +00:00
system_keyring.c	KEYS: correct alignment of system_certificate_list content in assembly file	2013-12-10 18:25:28 +00:00
task_work.c	task_work: documentation	2013-09-11 15:58:27 -07:00
taskstats.c	genetlink: only pass array to genl_register_family_with_ops()	2013-11-19 16:39:05 -05:00
test_kprobes.c	…
time.c	sched: Rename sched.c as sched/core.c in comments and Documentation	2013-06-19 12:58:42 +02:00
timeconst.bc	…
timer.c	timer: Prevent overflow in apply_slack	2014-04-30 13:46:17 +02:00
torture.c	rcutorture: Gracefully handle NULL cleanup hooks	2014-02-23 09:04:39 -08:00
tracepoint.c	tracepoint: Fix use of tracepoint funcs after rcu free	2014-05-08 09:10:56 -04:00
tsacct.c	…
uid16.c	userns: Kill nsown_capable it makes the wrong thing easy	2013-08-30 23:44:11 -07:00
up.c	smp: Rename __smp_call_function_single() to smp_call_function_single_async()	2014-02-24 14:47:15 -08:00
user-return-notifier.c	…
user.c	kernel: audit/fix non-modular users of module_init in core code	2014-04-03 16:21:07 -07:00
user_namespace.c	user namespace: fix incorrect memory barriers	2014-04-14 16:03:02 -07:00
utsname.c	userns: Kill nsown_capable it makes the wrong thing easy	2013-08-30 23:44:11 -07:00
utsname_sysctl.c	…
watchdog.c	kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()	2014-04-18 16:40:08 -07:00
workqueue.c	workqueue: fix a possible race condition between rescuer and pwq-release	2014-04-18 12:33:29 -04:00
workqueue_internal.h	sched: Rename sched.c as sched/core.c in comments and Documentation	2013-06-19 12:58:42 +02:00