[3.8.y.z extended stable] Patch "futex: Prevent attaching to kernel threads" has been added to staging queue

[Kamal Mostafa]

This is a note to let you know that I have just added a patch titled

    futex: Prevent attaching to kernel threads

to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue

This patch is scheduled to be released in version 3.8.13.25.

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.8.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Kamal

------

>From f9907370a5a7846306ac5638a19754d25f5256b9 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx at linutronix.de>
Date: Mon, 12 May 2014 20:45:35 +0000
Subject: [PATCH 45/66] futex: Prevent attaching to kernel threads

commit f0d71b3dcb8332f7971b5f2363632573e6d9486a upstream.

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
Cc: Dave Jones <davej at redhat.com>
Cc: Linus Torvalds <torvalds at linux-foundation.org>
Cc: Peter Zijlstra <peterz at infradead.org>
Cc: Darren Hart <darren at dvhart.com>
Cc: Davidlohr Bueso <davidlohr at hp.com>
Cc: Steven Rostedt <rostedt at goodmis.org>
Cc: Clark Williams <williams at redhat.com>
Cc: Paul McKenney <paulmck at linux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs at cn.fujitsu.com>
Cc: Roland McGrath <roland at hack.frob.com>
Cc: Carlos ODonell <carlos at redhat.com>
Cc: Jakub Jelinek <jakub at redhat.com>
Cc: Michael Kerrisk <mtk.manpages at gmail.com>
Cc: Sebastian Andrzej Siewior <bigeasy at linutronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
Signed-off-by: Kamal Mostafa <kamal at canonical.com>
---
 kernel/futex.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/futex.c b/kernel/futex.c
index 50a0244..ef88446 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 	if (!p)
 		return -ESRCH;

+	if (!p->mm) {
+		put_task_struct(p);
+		return -EPERM;
+	}
+
 	/*
 	 * We need to look at the task state flags to figure out,
 	 * whether the task is exiting. To protect against the do_exit
--
1.9.1