futex: Prevent attaching to kernel threads

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Change-Id: Id43144232efa7c3ae7c630cffa69f55ff83d8fd9
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: poondog <markj338@gmail.com>
futex: Add another early deadlock detection check

Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
detection code of rtmutex:
  http://lkml.kernel.org/r/20140429151655.GA14277@redhat.com

That underlying issue has been fixed with a patch to the rtmutex code,
but the futex code must not call into rtmutex in that case because
    - it can detect that issue early
    - it avoids a different and more complex fixup for backing out

If the user space variable got manipulated to 0x80000000 which means
no lock holder, but the waiters bit set and an active pi_state in the
kernel is found we can figure out the recursive locking issue by
looking at the pi_state owner. If that is the current task, then we
can safely return -EDEADLK.

The check should have been added in commit 59fa62451 (futex: Handle
futex_pi OWNER_DIED take over correctly) already, but I did not see
the above issue caused by user space manipulation back then.

Change-Id: I038ce8d61ee0d427574939b048035877149a2981
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Dave Jones <davej@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <davidlohr@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Clark Williams <williams@redhat.com>
Cc: Paul McKenney <paulmck@linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@cn.fujitsu.com>
Cc: Roland McGrath <roland@hack.frob.com>
Cc: Carlos ODonell <carlos@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.097349971@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: poondog <markj338@gmail.com>
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from a non-pi futex to a pi futex with this call. If we attempt this,
then dangling pointers may be left for rt_waiter resulting in an
exploitable condition.

This change brings futex_requeue() into line with
futex_wait_requeue_pi() which performs the same check as per commit
6f7b0a2a5 (futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[ tglx: Compare the resulting keys as well, as uaddrs might be
  	different depending on the mapping ]

Fixes CVE-2014-3153.

Change-Id: I6bfa0943ee54d6331e6faa7779d621f9cf19fe52
Reported-by: Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: poondog <markj338@gmail.com>
futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against rogue
user space which sets the user space futex to 0, so the kernel side
acquisition succeeds while there is existing state in the kernel
associated to the real owner.

Verify whether the futex has waiters associated with kernel state. If
it has, return -EINVAL. The state is corrupted already, so no point in
cleaning it up. Subsequent calls will fail as well. Not our problem.

[ tglx: Use futex_top_waiter() and explain why we do not need to try
  	restoring the already corrupted user space state. ]

Change-Id: Ifca31cf91f32a408171a01b8db1e49c14411a776
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: poondog <markj338@gmail.com>
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex. So the owner TID of the current owner
(the unlocker) persists. That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Change-Id: I8708a8c38c82ac4565634421fce8f916a6da873b
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: poondog <markj338@gmail.com>
futex: Make lookup_pi_state more robust

The current implementation of lookup_pi_state has ambigous handling of
the TID value 0 in the user space futex. We can get into the kernel
even if the TID value is 0, because either there is a stale waiters
bit or the owner died bit is set or we are called from the requeue_pi
path or from user space just for fun.

The current code avoids an explicit sanity check for pid = 0 in case
that kernel internal state (waiters) are found for the user space
address. This can lead to state leakage and worse under some
circumstances.

Handle the cases explicit:

     Waiter | pi_state | pi->owner | uTID      | uODIED | ?

[1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
[2]  NULL   | ---      | ---       | >0        | 0/1    | Valid

[3]  Found  | NULL     | --        | Any       | 0/1    | Invalid

[4]  Found  | Found    | NULL      | 0         | 1      | Valid
[5]  Found  | Found    | NULL      | >0        | 1      | Invalid

[6]  Found  | Found    | task      | 0         | 1      | Valid

[7]  Found  | Found    | NULL      | Any       | 0      | Invalid

[8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
[9]  Found  | Found    | task      | 0         | 0      | Invalid
[10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid

[1]  Indicates that the kernel can acquire the futex atomically. We
     came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.

[2]  Valid, if TID does not belong to a kernel thread. If no matching
     thread is found then it indicates that the owner TID has died.

[3]  Invalid. The waiter is queued on a non PI futex

[4]  Valid state after exit_robust_list(), which sets the user space
     value to FUTEX_WAITERS | FUTEX_OWNER_DIED.

[5]  The user space value got manipulated between exit_robust_list()
     and exit_pi_state_list()

[6]  Valid state after exit_pi_state_list() which sets the new owner in
     the pi_state but cannot access the user space value.

[7]  pi_state->owner can only be NULL when the OWNER_DIED bit is set.

[8]  Owner and user space value match

[9]  There is no transient state which sets the user space TID to 0
     except exit_robust_list(), but this is indicated by the
     FUTEX_OWNER_DIED bit. See [4]

[10] There is no transient state which leaves owner and user space
     TID out of sync.

Backport to 3.13
  conflicts: kernel/futex.c

Change-Id: Ibec82fe154f4ed702332d2d259ec88317b6fede1
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: poondog <markj338@gmail.com>
BUILD: v101

Signed-off-by: poondog <markj338@gmail.com>
PATCH: Linux 3.4.95

Eric Dumazet (1):
      net: fix inet_getid() and ipv6_select_ident() bugs

Greg Kroah-Hartman (2):
      lzo: properly check for overruns
      Linux 3.4.95

Jiri Pirko (1):
      team: fix mtu setting

Johan Hovold (7):
      USB: cdc-acm: fix write and suspend race
      USB: cdc-acm: fix write and resume race
      USB: cdc-acm: fix broken runtime suspend
      USB: cdc-acm: fix runtime PM for control messages
      USB: cdc-acm: fix shutdown and suspend race
      USB: cdc-acm: fix I/O after failed open
      USB: cdc-acm: fix runtime PM imbalance at shutdown

Kailang Yang (1):
      ALSA: hda/realtek - Add support of ALC891 codec

Lars-Peter Clausen (5):
      ALSA: control: Protect user controls against concurrent access
      ALSA: control: Fix replacing user controls
      ALSA: control: Don't access controls outside of protected regions
      ALSA: control: Handle numid overflow
      ALSA: control: Make sure that id->index does not overflow

Markus F.X.J. Oberhumer (2):
      lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c
      lib/lzo: Update LZO compression to current upstream version

Michal Schmidt (1):
      netlink: rate-limit leftover bytes warning and print process name

Mimi Zohar (1):
      evm: prohibit userspace writing 'security.evm' HMAC value

Nicholas Bellinger (1):
      iscsi-target: Reject mutual authentication with reflected CHAP_C

Thomas Gleixner (1):
      nohz: Fix another inconsistency between CONFIG_NO_HZ=n and nohz=off

Tom Gundersen (1):
      net: tunnels - enable module autoloading

Wei Yang (2):
      mlx4_core: Stash PCI ID driver_data in mlx4_priv structure
      net/mlx4_core: Preserve pci_dev_data after __mlx4_remove_one()

Xufeng Zhang (1):
      sctp: Fix sk_ack_backlog wrap-around problem

Signed-off-by: poondog <markj338@gmail.com>
BUILD: v102

Signed-off-by: poondog <markj338@gmail.com>
Revert "msm: kgsl: report gpu frequency correctly in sysfs"

This reverts commit 70a29427ecee7aa8952f4a751445a153ef511faf.
msm: kgsl: Fix policy sysfs implementation

When switching to another governor, the pwrscale kobject will be deleted
and sysfs_create_group fails due to the uninitialized kobj. This patch
deletes the kobject before attaching the file group.

[   36.270044] [<c0134304>] (__kmalloc_track_caller+0x80/0x194) from [<c010a6d0>] (kstrdup+0x2c/0x54)
[   36.270166] [<c010a6d0>] (kstrdup+0x2c/0x54) from [<c019cc98>] (create_dir+0x24/0x204)
[   36.270257] [<c019cc98>] (create_dir+0x24/0x204) from [<c019d154>] (sysfs_create_subdir+0x24/0x2c)
[   36.270318] [<c019d154>] (sysfs_create_subdir+0x24/0x2c) from [<c019e878>] (sysfs_create_group+0x40/0x1d8)
[   36.270441] [<c019e878>] (sysfs_create_group+0x40/0x1d8) from [<c0389e40>] (kgsl_pwrscale_policy_add_files+0x44/0x68)
[   36.270563] [<c0389e40>] (kgsl_pwrscale_policy_add_files+0x44/0x68) from [<c038e714>] (conservative_init+0xc/0x18)
[   36.270654] [<c038e714>] (conservative_init+0xc/0x18) from [<c0389c6c>] (pwrscale_policy_store+0xcc/0x154)
[   36.270776] [<c0389c6c>] (pwrscale_policy_store+0xcc/0x154) from [<c0389a90>] (pwrscale_sysfs_store+0x20/0x2c)
[   36.270868] [<c0389a90>] (pwrscale_sysfs_store+0x20/0x2c) from [<c019b2a4>] (sysfs_write_file+0x168/0x198)
[   36.270990] [<c019b2a4>] (sysfs_write_file+0x168/0x198) from [<c01382c4>] (vfs_write+0x9c/0x170)
[   36.271112] [<c01382c4>] (vfs_write+0x9c/0x170) from [<c0138440>] (sys_write+0x38/0x70)
[   36.271173] [<c0138440>] (sys_write+0x38/0x70) from [<c000f000>] (ret_fast_syscall+0x0/0x30)
[   36.271265] Code: e7925001 e3550000 0a000033 e5942014 (e795a002)
[   36.271661] ---[ end trace ef0d8b9c8acc7bbb ]---

Signed-off-by: poondog <markj338@gmail.com>
msm: kgsl: Report GPU frequency correctly in sysfs

Signed-off-by: poondog <markj338@gmail.com>
msm: kgsl: Add an input handler to power up the GPU on a touch event

On a device where the primary input is a touchscreen nobody is
surprised that touch events are often the catalyst for drawing
frames. If the GPU is in slumber we can get a jump on the action
by watching for touch events and turning the GPU on in anticipation
of a draw call. Register for events from all input drivers
returning EV_ABS events and queue a work task to power up the GPU
if it is currently in slumber.

Change-Id: Ic0dedbadbdc96ef9ddd78252ea65f8e1cdd00110
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: poondog <markj338@gmail.com>
BUILD: v103

Signed-off-by: poondog <markj338@gmail.com>
ARM: 8008/1: topology: Coding style fixes

Use kcalloc() and ULONG_MAX rather than open coding them.

Signed-off-by: Mark Brown <broonie@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: poondog <markj338@gmail.com>
ARM: topology: Add efficiency coefficient for Krait

* Instead using default value of CPU efficiency,
  use same as that of cortex-a15.

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
Signed-off-by: poondog <markj338@gmail.com>
BUILD: v104

Signed-off-by: poondog <markj338@gmail.com>
Revert "slimbus: Add Qualcomm Slimbus driver"

This reverts commit 3bb5ffe119ee0ffd1e1d1153737ec327dee3addf.
SLIMBUS: add back stock modified drivers. Perhaps this is our sound issue

Signed-off-by: poondog <markj338@gmail.com>
BUILD: v105

Signed-off-by: poondog <markj338@gmail.com>