This repository has been archived on 2026-03-14. You can view files and clone it, but cannot push or open issues or pull requests.

Linus Torvalds 8ff40b2c3c futex: fix handling of read-only-mapped hugepages ...

CVE-2014-3153

commit f12d5bfceb7e1f9051563381ec047f7f13956c3c upstream.

The hugepage code had the exact same bug that regular pages had in
commit 7485d0d375 ("futexes: Remove rw parameter from
get_futex_key()").

The regular page case was fixed by commit 9ea71503a8 ("futex: Fix
regression with read only mappings"), but the transparent hugepage case
(added in a5b338f2b0: "thp: update futex compound knowledge") case
remained broken.

Found by Dave Jones and his trinity tool.

Reported-and-tested-by: Dave Jones <davej@fedoraproject.org>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

2014-06-27 08:15:42 -06:00

..

debug

debug: add parameters to prevent entering debug mode on errors

2012-05-18 17:03:10 -07:00

events

perf: Treat attr.config as u64 in perf_swevent_init()

2014-06-26 13:36:31 -06:00

gcov

gcov: disable CONSTRUCTORS for UML

2011-07-26 16:49:45 -07:00

irq

random: remove rand_initialize_irq()

2013-09-09 17:01:42 -07:00

power

freezer: shorten freezer sleep time using exponential backoff

2013-07-12 14:22:56 -07:00

sched

wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task

2014-06-26 13:20:19 -06:00

time

timekeeping: fix 32-bit overflow in get_monotonic_boottime

2013-04-18 16:08:05 -07:00

trace

trace/events: add gpu trace events

2013-04-18 16:08:19 -07:00

.gitignore

…

acct.c

Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2012-01-08 12:19:57 -08:00

async.c

kernel/async: remove redundant declaration.

2012-01-13 09:32:18 +10:30

audit_tree.c

audit_tree,rcu: Convert call_rcu(__put_tree) to kfree_rcu()

2011-07-20 14:10:11 -07:00

audit_watch.c

…

audit.c

constify path argument of audit_log_d_path()

2012-03-20 21:29:40 -04:00

audit.h

audit: remove AUDIT_SETUP_CONTEXT as it isn't used

2012-01-17 16:16:57 -05:00

auditfilter.c

audit: allow interfield comparison in audit rules

2012-01-17 16:17:01 -05:00

auditsc.c

kernel-doc: fix new warnings in auditsc.c

2012-01-23 08:44:53 -08:00

backtracetest.c

…

bounds.c

…

capability.c

Revert "capabitlies: ns_capable can use the cap helpers rather than lsm call"

2012-01-17 10:19:41 -08:00

cgroup_freezer.c

cgroup: remove cgroup_subsys argument from callbacks

2012-02-02 09:20:22 -08:00

cgroup.c

cgroup: Remove call to synchronize_rcu in cgroup_attach_task

2012-04-09 13:53:12 -07:00

compat.c

compat: Fix RT signal mask corruption via sigprocmask

2012-05-10 08:58:33 -07:00

configs.c

kernel/configs.c: include MODULE_*() when CONFIG_IKCONFIG_PROC=n

2011-07-25 20:57:15 -07:00

cpu_pm.c

cpu_pm: call notifiers during suspend

2011-09-23 12:05:29 +05:30

cpu.c

Move x86_64 idle notifiers to generic

2012-04-09 13:57:52 -07:00

cpuset.c

Merge tag 'for-linus' of git://github.com/rustyrussell/linux

2012-04-02 08:53:24 -07:00

crash_dump.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

cred.c

cred: copy_process() should clear child->replacement_session_keyring

2012-04-11 08:20:11 -07:00

delayacct.c

KVM: Steal time implementation

2011-07-14 12:59:14 +03:00

dma.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

elfcore.c

…

exec_domain.c

…

exit.c

lockdep: remove task argument from debug_check_no_locks_held

2013-07-12 14:22:56 -07:00

extable.c

…

fork.c

android/lowmemorykiller: Ignore tasks with freed mm

2013-03-15 17:08:47 -07:00

freezer.c

freezer: skip waking up tasks with PF_FREEZER_SKIP set

2013-07-12 14:22:56 -07:00

futex_compat.c

futex: Revert "futex: Mark get_robust_list as deprecated"

2014-06-27 08:15:42 -06:00

futex.c

futex: fix handling of read-only-mapped hugepages

2014-06-27 08:15:42 -06:00

groups.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

hrtimer.c

nanosleep: use freezable blocking call

2013-07-12 14:22:58 -07:00

hung_task.c

hung_task: fix the broken rcu_lock_break() logic

2012-03-05 15:49:42 -08:00

irq_work.c

irq_work: fix compile failure on tile from missing include

2012-04-13 13:15:16 -04:00

itimer.c

itimer: Use printk_once instead of WARN_ONCE

2012-04-10 11:00:30 +02:00

jump_label.c

static keys: Inline the static_key_enabled() function

2012-02-28 20:01:08 +01:00

kallsyms.c

vsprintf: Fix %ps on non symbols when using kallsyms

2013-02-08 15:14:22 -08:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

Kconfig.preempt

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

kexec.c

Merge branch 'akpm' (Andrew's patch-bomb)

2012-03-28 17:19:28 -07:00

kfifo.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

kmod.c

PM / Sleep: Mitigate race between the freezer and request_firmware()

2012-03-28 23:30:28 +02:00

kprobes.c

kprobes: return proper error code from register_kprobe()

2012-03-05 15:49:42 -08:00

ksysfs.c

kernel: ksysfs.c is implicitly using stat.h

2011-10-31 09:20:13 -04:00

kthread.c

freezer: kill unused set_freezable_with_signal()

2011-11-23 09:28:17 -08:00

latencytop.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_internals.h

…

lockdep_proc.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_states.h

…

lockdep.c

lockdep: remove task argument from debug_check_no_locks_held

2013-07-12 14:22:56 -07:00

Makefile

sysctl: Move the implementation into fs/proc/proc_sysctl.c

2012-01-24 16:37:54 -08:00

module.c

module: Remove module size limit

2012-03-26 12:50:53 +10:30

mutex-debug.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mutex-debug.h

…

mutex.c

sched/rt: Use schedule_preempt_disabled()

2012-03-01 10:28:03 +01:00

mutex.h

…

notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

nsproxy.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

padata.c

padata: Fix cpu hotplug

2012-03-29 19:52:46 +08:00

panic.c

panic: resume console if panic after console suspend.

2013-09-09 17:16:14 -07:00

params.c

params: <level>_initcall-like kernel parameters

2012-03-26 12:50:51 +10:30

pid_namespace.c

pidns: add reboot_pid_ns() to handle the reboot syscall

2012-03-28 17:14:36 -07:00

pid.c

vfs: fix panic in __d_lookup() with high dentry hashtable counts

2012-02-13 20:45:38 -05:00

posix-cpu-timers.c

[S390] cputime: add sparse checking and cleanup

2011-12-15 14:56:19 +01:00

posix-timers.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

printk.c

panic: resume console if panic after console suspend.

2013-09-09 17:16:14 -07:00

profile.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

ptrace.c

ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL

2014-06-26 13:20:19 -06:00

range.c

range: fix bogus misuse of module.h to get printk()

2011-10-31 09:20:11 -04:00

rcu.h

rcu: Allow nesting of rcu_idle_enter() and rcu_idle_exit()

2012-02-21 09:06:12 -08:00

rcupdate.c

rcu: Check for illegal use of RCU from offlined CPUs

2012-02-21 09:06:03 -08:00

rcutiny_plugin.h

rcu: Simplify unboosting checks

2012-02-21 09:03:43 -08:00

rcutiny.c

rcu: Add RCU_NONIDLE() for idle-loop RCU read-side critical sections

2012-02-21 09:06:13 -08:00

rcutorture.c

PTR_ERR should be called before its argument is cleared.

2012-02-21 09:06:10 -08:00

rcutree_plugin.h

rcu: Hold off RCU_FAST_NO_HZ after timer posted

2012-02-21 09:42:30 -08:00

rcutree_trace.c

rcu: Rework detection of use of RCU by offline CPUs

2012-02-21 09:06:07 -08:00

rcutree.c

rcu: Fix day-one dyntick-idle stall-warning bug

2013-02-08 15:14:25 -08:00

rcutree.h

rcu: Rework detection of use of RCU by offline CPUs

2012-02-21 09:06:07 -08:00

relay.c

relay: prevent integer overflow in relay_open()

2012-02-10 09:04:49 +01:00

res_counter.c

net: introduce res_counter_charge_nofail() for socket allocations

2012-01-22 15:08:46 -05:00

resource.c

DMM: Fix for movable bytes near end of address space

2013-02-20 02:50:30 -08:00

rtmutex_common.h

…

rtmutex-debug.c

lockdep, rtmutex, bug: Show taint flags on error

2011-12-06 08:16:49 +01:00

rtmutex-debug.h

…

rtmutex-tester.c

rtmutex-tester: convert sysdev_class to a regular subsystem

2011-12-14 14:54:22 -08:00

rtmutex.c

Revert "rcu: Permit rt_mutex_unlock() with irqs disabled"

2011-12-11 10:33:18 -08:00

rtmutex.h

…

rwsem.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

seccomp.c

seccomp: audit abnormal end to a process due to seccomp

2012-01-17 16:16:55 -05:00

semaphore.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

signal.c

ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL

2014-06-26 13:20:19 -06:00

smp.c

smp: add func to IPI cpus based on parameter func

2012-03-28 17:14:35 -07:00

softirq.c

Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2012-03-20 10:32:09 -07:00

spinlock.c

locking/kconfig: Simplify INLINE_SPIN_UNLOCK usage

2012-03-23 13:18:57 +01:00

srcu.c

rcu: Call out dangers of expedited RCU primitives

2012-02-21 09:06:08 -08:00

stacktrace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

stop_machine.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

sys_ni.c

Cross Memory Attach

2011-10-31 17:30:44 -07:00

sys.c

use clamp_t in UNAME26 fix

2014-06-26 12:52:23 -06:00

sysctl_binary.c

msm: 8x55: put reason for boot in procfs from SMEM

2013-02-08 15:14:28 -08:00

sysctl.c

Revert "sched: add sysctl for controlling task migrations on wake"

2013-03-15 17:13:14 -07:00

taskstats.c

Make TASKSTATS require root access

2011-09-19 17:04:37 -07:00

test_kprobes.c

…

time.c

time: Remove bogus comments

2012-03-15 18:17:55 -07:00

timeconst.pl

…

timer.c

timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE

2013-06-24 18:55:42 +00:00

tracepoint.c

static keys: Introduce 'struct static_key', static_key_true()/false() and static_key_slow_[inc|dec]()

2012-02-24 10:05:59 +01:00

tsacct.c

[S390] cputime: add sparse checking and cleanup

2011-12-15 14:56:19 +01:00

uid16.c

…

up.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user_namespace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user-return-notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

utsname_sysctl.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

utsname.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

wait.c

lockdep/waitqueues: Add better annotation

2011-12-21 10:07:39 +01:00

watchdog.c

kernel/watchdog.c: add comment to watchdog() exit path

2012-03-23 16:58:32 -07:00

workqueue_sched.h

…

workqueue.c

workqueue: skip nr_running sanity check in worker_enter_idle() if trustee is active

2013-03-04 12:48:24 -08:00