futex: Validate atomic acquisition in futex_lock_pi_atomic()
authorThomas Gleixner <tglx@linutronix.de>
Tue, 3 Jun 2014 12:27:06 +0000 (12:27 +0000)
committerLinus Torvalds <torvalds@linux-foundation.org>
Thu, 5 Jun 2014 19:31:07 +0000 (12:31 -0700)
commitb3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
treee5ce59530597f9d35a3792f5b17d043be7de9d43
parente9c243a5a6de0be8e584c604d353412584b592f8
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state.  If
it has, return -EINVAL.  The state is corrupted already, so no point in
cleaning it up.  Subsequent calls will fail as well.  Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
   restoring the already corrupted user space state. ]

Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/futex.c