aboutsummaryrefslogtreecommitdiffstats
path: root/lib/sort.c
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2014-05-12 10:45:06 -0200
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-12-06 18:15:42 +0100
commit2e84f00139901761cc714cc73a8370f02cb50301 (patch)
treecbd7f85cdfcb15a2ddf9322bd97f49c260a3cc5c /lib/sort.c
parentbb2f713fd822784aa9f0bcb70c4d4a3401c65c63 (diff)
downloadkernel_samsung_smdk4412-2e84f00139901761cc714cc73a8370f02cb50301.zip
kernel_samsung_smdk4412-2e84f00139901761cc714cc73a8370f02cb50301.tar.gz
kernel_samsung_smdk4412-2e84f00139901761cc714cc73a8370f02cb50301.tar.bz2
futex: Prevent attaching to kernel threads
commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream. We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex. Found while analysing the fallout of Dave Jones syscall fuzzer. We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Dave Jones <davej@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Darren Hart <darren@dvhart.com> Cc: Davidlohr Bueso <davidlohr@hp.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Clark Williams <williams@redhat.com> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: Lai Jiangshan <laijs@cn.fujitsu.com> Cc: Roland McGrath <roland@hack.frob.com> Cc: Carlos ODonell <carlos@redhat.com> Cc: Jakub Jelinek <jakub@redhat.com> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Tested-by: Moritz Bandemer <replicant@posteo.mx>
Diffstat (limited to 'lib/sort.c')
0 files changed, 0 insertions, 0 deletions