aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/itimer.c
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2014-05-12 20:45:35 +0000
committerPaul Kocialkowski <contact@paulk.fr>2014-07-17 16:50:06 +0200
commit8f919efbe28f4d83575443b2e3fdc5219199618d (patch)
tree78e3cdb9b9bf83a53f0d7e8f912b6e8bd4e5b903 /kernel/itimer.c
parentef02c76b182042a0587ea1e718331f618f87baff (diff)
downloadkernel_samsung_crespo-8f919efbe28f4d83575443b2e3fdc5219199618d.zip
kernel_samsung_crespo-8f919efbe28f4d83575443b2e3fdc5219199618d.tar.gz
kernel_samsung_crespo-8f919efbe28f4d83575443b2e3fdc5219199618d.tar.bz2
futex: Prevent attaching to kernel threads
We happily allow userspace to declare a random kernel thread to be the owner of a user space PI futex. Found while analysing the fallout of Dave Jones syscall fuzzer. We also should validate the thread group for private futexes and find some fast way to validate whether the "alleged" owner has RW access on the file which backs the SHM, but that's a separate issue. Change-Id: I03941dc5737bcb9d3ddd2ec88f7c263c27a1247d Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Dave Jones <davej@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Darren Hart <darren@dvhart.com> Cc: Davidlohr Bueso <davidlohr@hp.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Clark Williams <williams@redhat.com> Cc: Paul McKenney <paulmck@linux.vnet.ibm.com> Cc: Lai Jiangshan <laijs@cn.fujitsu.com> Cc: Roland McGrath <roland@hack.frob.com> Cc: Carlos ODonell <carlos@redhat.com> Cc: Jakub Jelinek <jakub@redhat.com> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org
Diffstat (limited to 'kernel/itimer.c')
0 files changed, 0 insertions, 0 deletions