aboutsummaryrefslogtreecommitdiffstats
path: root/scripts/depmod.sh
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2014-06-03 02:27:06 -0200
committerWolfgang Wiedmeyer <wolfgit@wiedmeyer.de>2015-12-06 18:16:17 +0100
commitf6c159bcf25b0020872a23f4c04176014581ee9a (patch)
tree801a567e287fe4d7cef76d95694c1730725a5698 /scripts/depmod.sh
parent2e84f00139901761cc714cc73a8370f02cb50301 (diff)
downloadkernel_samsung_smdk4412-f6c159bcf25b0020872a23f4c04176014581ee9a.zip
kernel_samsung_smdk4412-f6c159bcf25b0020872a23f4c04176014581ee9a.tar.gz
kernel_samsung_smdk4412-f6c159bcf25b0020872a23f4c04176014581ee9a.tar.bz2
futex: Validate atomic acquisition in futex_lock_pi_atomic()
commit b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 upstream. We need to protect the atomic acquisition in the kernel against rogue user space which sets the user space futex to 0, so the kernel side acquisition succeeds while there is existing state in the kernel associated to the real owner. Verify whether the futex has waiters associated with kernel state. If it has, return -EINVAL. The state is corrupted already, so no point in cleaning it up. Subsequent calls will fail as well. Not our problem. [ tglx: Use futex_top_waiter() and explain why we do not need to try restoring the already corrupted user space state. ] Signed-off-by: Darren Hart <dvhart@linux.intel.com> Cc: Kees Cook <keescook@chromium.org> Cc: Will Drewry <wad@chromium.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Tested-by: Moritz Bandemer <replicant@posteo.mx>
Diffstat (limited to 'scripts/depmod.sh')
0 files changed, 0 insertions, 0 deletions