aboutsummaryrefslogtreecommitdiffstats
path: root/sound/soc/tegra/harmony.c
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2014-06-03 12:27:06 +0000
committerPaul Kocialkowski <contact@paulk.fr>2014-07-17 16:50:06 +0200
commit48c9b318d2fe0d3f2899e16e08f0972ffbd8c2b5 (patch)
treeba8d23253918ab7876d0fdc24a7e499ab90dce10 /sound/soc/tegra/harmony.c
parent3f77878d2e73858ec1a559666aeed198bced6902 (diff)
downloadkernel_samsung_crespo-48c9b318d2fe0d3f2899e16e08f0972ffbd8c2b5.zip
kernel_samsung_crespo-48c9b318d2fe0d3f2899e16e08f0972ffbd8c2b5.tar.gz
kernel_samsung_crespo-48c9b318d2fe0d3f2899e16e08f0972ffbd8c2b5.tar.bz2
futex: Validate atomic acquisition in futex_lock_pi_atomic()
We need to protect the atomic acquisition in the kernel against rogue user space which sets the user space futex to 0, so the kernel side acquisition succeeds while there is existing state in the kernel associated to the real owner. Verify whether the futex has waiters associated with kernel state. If it has, return -EINVAL. The state is corrupted already, so no point in cleaning it up. Subsequent calls will fail as well. Not our problem. [ tglx: Use futex_top_waiter() and explain why we do not need to try restoring the already corrupted user space state. ] Change-Id: Ic8714ed2e9dee323a011eed42f7c0159c65dfbf3 Signed-off-by: Darren Hart <dvhart@linux.intel.com> Cc: Kees Cook <keescook@chromium.org> Cc: Will Drewry <wad@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Diffstat (limited to 'sound/soc/tegra/harmony.c')
0 files changed, 0 insertions, 0 deletions