futex: Validate atomic acquisition in futex_lock_pi_atomic()

We need to protect the atomic acquisition in the kernel against
rogue
user space which sets the user space futex to 0, so the kernel
side
acquisition succeeds while there is existing state in the
kernel
associated to the real owner.

Verify whether the futex has
waiters associated with kernel state. If
it has, return -EINVAL. The
state is corrupted already, so no point in
cleaning it up. Subsequent
calls will fail as well. Not our problem.

[ tglx: Use
futex_top_waiter() and explain why we do not need to try
   restoring
the already corrupted user space state. ]

Signed-off-by: Darren Hart
<dvhart@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will
Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by:
Thomas Gleixner <tglx@linutronix.de>

Change-Id:
I6c19ae4a5e85fbc9c560723e672d5136c4786ab6

idea is taken here -
https://github.com/rmbq/android_kernel_htc_msm8960/commit/6f29030a41618fb1e10340512eec1cbb98a04f5f