futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

If uaddr == uaddr2, then we have broken the rule of only requeueing
from
a non-pi futex to a pi futex with this call. If we attempt this,
then
dangling pointers may be left for rt_waiter resulting in an
exploitable
condition.

This change brings futex_requeue() into line
with
futex_wait_requeue_pi() which performs the same check as per
commit
(futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi())

[
tglx: Compare the resulting keys as well, as uaddrs might be

different depending on the mapping ]

Fixes CVE-2014-3153.

Reported-by:
Pinkie Pie
Signed-off-by: Will Drewry <wad@chromium.org>
Signed-off-by:
Kees Cook <keescook@chromium.org>
Cc:
stable@vger.kernel.org
Signed-off-by: Thomas Gleixner
<tglx@linutronix.de>

Change-Id:
Iea1dfe1d877d63a374db2623dca6cea4e7a544b9

idea is taken here -
https://github.com/rmbq/android_kernel_htc_msm8960/commit/9dda0ef0cf0d6cc0565c5d886f0c4dc8edbab26e