futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule
of only requeueing from a non-pi futex to a pi
futex with this call.  If we attempt this, then
dangling pointers may be left for rt_waiter
resulting in an exploitable condition.
This change brings futex_requeue() in line with
futex_wait_requeue_pi() which performs the same
check as per commit 6f7b0a2a5c0f ("futex: Forbid
uaddr == uaddr2 in futex_wait_requeue_pi()")#
(use "git reset HEAD <file>..." to unstage)
[ tglx: Compare the resulting keys as well, as
uaddrs might be different depending on the
mapping ]# Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org Signed-off-by: Thomas
Gleixner <tglx@linutronix.de> Reviewed-by:
Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change-Id: Ibb13e71380d722436615348e34f919c5914e7e1a