Thomas Gleixner ccf9e6a80d futex: Make unlock_pi more robust ... The kernel tries to atomically unlock the futex without checking whether there is kernel state associated to the futex. So if user space manipulated the user space value, this will leave kernel internal state around associated to the owner task. For robustness sake, lookup first whether there are waiters on the futex. If there are waiters, wake the top priority waiter with all the proper sanity checks applied. If there are no waiters, do the atomic release. We do not have to preserve the waiters bit in this case, because a potentially incoming waiter is blocked on the hb->lock and will acquire the futex atomically. We neither have to preserve the owner died bit. The caller is the owner and it was supposed to cleanup the mess. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Darren Hart <darren@dvhart.com> Cc: Davidlohr Bueso <davidlohr@hp.com> Cc: Kees Cook <kees@outflux.net> Cc: wad@chromium.org Link: http://lkml.kernel.org/r/20140611204237.016987332@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de>		2014-06-21 22:26:23 +02:00
..
debug	kernel/printk: use symbolic defines for console loglevels	2014-06-04 16:54:17 -07:00
events	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-06-12 19:18:49 -07:00
gcov	gcov: add support for GCC 4.9	2014-06-10 15:34:46 -07:00
irq	genirq: Improve documentation to match current implementation	2014-05-27 10:16:44 +02:00
locking	rtmutex: Avoid pointless requeueing in the deadlock detection chain walk	2014-06-21 22:05:31 +02:00
power	Merge branch 'pm-sleep'	2014-06-12 13:43:08 +02:00
printk	kernel/printk: use symbolic defines for console loglevels	2014-06-04 16:54:17 -07:00
rcu	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-03 12:57:53 -07:00
sched	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2014-06-12 19:42:15 -07:00
time	Merge branch 'akpm' (patchbomb from Andrew) into next	2014-06-04 16:55:13 -07:00
trace	One bug fix that goes back to 3.10. Accessing a non existent buffer	2014-06-12 21:07:25 -07:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	locking/rwlocks: Introduce 'qrwlocks' - fair, queued rwlocks	2014-06-06 07:58:28 +02:00
Kconfig.preempt	…
Makefile	…
acct.c	ipc, kernel: clear whitespace	2014-06-06 16:08:14 -07:00
async.c	…
audit.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
audit.h	…
audit_tree.c	…
audit_watch.c	…
auditfilter.c	Merge git://git.infradead.org/users/eparis/audit	2014-04-12 12:38:53 -07:00
auditsc.c	auditsc: audit_krule mask accesses need bounds checking	2014-06-10 08:44:40 -07:00
backtracetest.c	kernel/backtracetest.c: replace no level printk by pr_info()	2014-06-04 16:54:14 -07:00
bounds.c	…
capability.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
cgroup.c	Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-06-09 15:03:33 -07:00
cgroup_freezer.c	cgroup: remove css_parent()	2014-05-16 13:22:48 -04:00
compat.c	kernel/compat.c: use sizeof() instead of sizeof	2014-06-04 16:54:19 -07:00
configs.c	…
context_tracking.c	asmlinkage: Add explicit __visible to drivers/*, lib/*, kernel/*	2014-05-05 16:07:46 -07:00
cpu.c	More ACPI and power management updates for 3.16-rc1	2014-06-12 13:14:19 -07:00
cpu_pm.c	…
cpuset.c	Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2014-06-09 15:03:33 -07:00
crash_dump.c	…
cred.c	…
delayacct.c	…
dma.c	…
elfcore.c	…
exec_domain.c	kernel/exec_domain.c: code clean-up	2014-06-04 16:54:15 -07:00
exit.c	signals: mv {dis,}allow_signal() from sched.h/exit.c to signal.[ch]	2014-06-06 16:08:11 -07:00
extable.c	…
fork.c	ptrace: fix fork event messages across pid namespaces	2014-06-06 16:08:11 -07:00
freezer.c	…
futex.c	futex: Make unlock_pi more robust	2014-06-21 22:26:23 +02:00
futex_compat.c	…
groups.c	…
hrtimer.c	Merge branch 'perf/urgent' into perf/core, to resolve conflict and to prepare for new patches	2014-06-06 07:55:06 +02:00
hung_task.c	kernel/hung_task.c: convert simple_strtoul to kstrtouint	2014-06-04 16:54:15 -07:00
irq_work.c	…
itimer.c	…
jump_label.c	…
kallsyms.c	kernel: use macros from compiler.h instead of __attribute__((...))	2014-04-07 16:36:11 -07:00
kcmp.c	…
kexec.c	kernel/kexec.c: convert printk to pr_foo()	2014-06-06 16:08:12 -07:00
kmod.c	signals: change wait_for_helper() to use kernel_sigaction()	2014-06-06 16:08:12 -07:00
kprobes.c	kprobes: Show blacklist entries via debugfs	2014-04-24 10:26:41 +02:00
ksysfs.c	kobject: Make support for uevent_helper optional.	2014-04-25 12:00:49 -07:00
kthread.c	kthread: fix return value of kthread_create() upon SIGKILL.	2014-06-04 16:53:51 -07:00
latencytop.c	kernel/latencytop.c: convert seq_printf to seq_puts	2014-06-04 16:54:15 -07:00
module-internal.h	…
module.c	Most of this is cleaning up various driver sysfs permissions so we can	2014-06-11 16:09:14 -07:00
module_signing.c	…
notifier.c	kprobes, notifier: Use NOKPROBE_SYMBOL macro in notifier	2014-04-24 10:26:39 +02:00
nsproxy.c	…
padata.c	…
panic.c	kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump after panic_notifers	2014-06-06 16:08:12 -07:00
params.c	param: hand arguments after -- straight to init	2014-04-28 11:48:34 +09:30
pid.c	…
pid_namespace.c	…
posix-cpu-timers.c	…
posix-timers.c	…
profile.c	kernel/profile.c: use static const char instead of static char	2014-06-06 16:08:13 -07:00
ptrace.c	…
range.c	…
reboot.c	kernel/reboot.c: convert simple_strtoul to kstrtoint	2014-06-04 16:54:15 -07:00
relay.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-04-12 14:49:50 -07:00
res_counter.c	kernel/res_counter.c: replace simple_strtoull by kstrtoull	2014-06-04 16:54:15 -07:00
resource.c	resources: Clarify sanity check message	2014-05-23 10:47:21 -06:00
seccomp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
signal.c	signals: introduce kernel_sigaction()	2014-06-06 16:08:12 -07:00
smp.c	smp: print more useful debug info upon receiving IPI on an offline CPU	2014-06-06 16:08:12 -07:00
smpboot.c	…
smpboot.h	…
softirq.c	Merge branch 'rcu/next' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu	2014-05-22 11:36:10 +02:00
stacktrace.c	…
stop_machine.c	kernel/stop_machine.c: kernel-doc warning fix	2014-06-04 16:54:15 -07:00
sys.c	sched: Consolidate open coded implementations of nice level frobbing into nice_to_rlimit() and rlimit_to_nice()	2014-05-22 11:16:36 +02:00
sys_ni.c	sys_sgetmask/sys_ssetmask: add CONFIG_SGETMASK_SYSCALL	2014-06-04 16:54:14 -07:00
sysctl.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2014-06-12 14:27:40 -07:00
sysctl_binary.c	…
system_certificates.S	…
system_keyring.c	…
task_work.c	…
taskstats.c	…
test_kprobes.c	…
time.c	…
timeconst.bc	…
timer.c	timer: Prevent overflow in apply_slack	2014-04-30 13:46:17 +02:00
torture.c	torture: Remove __init from torture_init_begin/end	2014-05-14 09:46:30 -07:00
tracepoint.c	kernel/tracepoint.c: kernel-doc fixes	2014-06-04 16:54:15 -07:00
tsacct.c	…
uid16.c	…
up.c	…
user-return-notifier.c	…
user.c	kernel/user.c: drop unused field 'files' from user_struct	2014-06-04 16:54:16 -07:00
user_namespace.c	kernel/user_namespace.c: kernel-doc/checkpatch fixes	2014-06-06 16:08:13 -07:00
utsname.c	…
utsname_sysctl.c	sysctl: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
watchdog.c	kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()	2014-04-18 16:40:08 -07:00
workqueue.c	Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2014-06-09 14:56:49 -07:00
workqueue_internal.h	workqueue: rename manager_mutex to attach_mutex	2014-05-20 10:59:32 -04:00