Eric W. Biederman
ee6f7ee1e4
ucount: Remove the atomicity from ucount->count ...
commit 040757f738e13caaa9c5078bca79aa97e11dde88 upstream.
Always increment/decrement ucount->count under the ucounts_lock. The
increments are there already and moving the decrements there means the
locking logic of the code is simpler. This simplification in the
locking logic fixes a race between put_ucounts and get_ucounts that
could result in a use-after-free because the count could go zero then
be found by get_ucounts and then be freed by put_ucounts.
A bug presumably this one was found by a combination of syzkaller and
KASAN. JongWhan Kim reported the syzkaller failure and Dmitry Vyukov
spotted the race in the code.
Fixes: f6b2db1a3e
2017-03-18 19:14:29 +08:00
bpf: fix states equal logic for varlen access
2016-11-30 14:50:52 -05:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kernel/debug/debug_core.c: more properly delay for secondary CPUs
2017-01-06 10:40:17 +01:00
perf/core: Fix crash in perf_event_read()
2017-02-14 15:25:43 -08:00
gcov: add support for gcc version >= 6
2016-07-15 14:54:27 +09:00
irqdomain: Avoid activating interrupts more than once
2017-02-09 08:08:31 +01:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
lockdep: Fix report formatting
2016-12-06 10:40:08 +01:00
PM / sleep: fix device reference leak in test_suspend
2016-11-02 05:10:04 +01:00
printk: use rcuidle console tracepoint
2017-02-23 17:44:36 +01:00
rcu: Narrow early boot window of illegal synchronous grace periods
2017-01-26 08:24:37 +01:00
sched/autogroup: Fix 64-bit kernel nice level adjustment
2016-11-24 05:45:02 +01:00
timekeeping: Use deferred printk() in debug code
2017-02-23 17:44:36 +01:00
fs: Better permission checking for submounts
2017-03-15 10:02:44 +08:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-09-01 15:55:56 -07:00
audit: add fields to exclude filter by reusing user filter
2016-06-27 11:01:00 -04:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup: don't online subsystems before cgroup_name/path() are operational
2017-02-09 08:08:28 +01:00
cgroup: Use lld instead of ld when printing pids controller events_limit
2016-06-21 15:03:36 -04:00
hotplug: Make register and unregister notifier API symmetric
2017-01-06 10:40:10 +01:00
Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2016-10-14 12:18:50 -07:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
sched/autogroup: Do not use autogroup->tg in zombie threads
2016-11-22 12:33:43 +01:00
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
2017-01-06 10:40:13 +01:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Move futex_init() to core_initcall
2017-02-23 17:44:36 +01:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
hung_task: allow hung_task_panic when hung_task_warnings is 0
2016-10-11 15:06:33 -07:00
jump_labels: API for flushing deferred jump label updates
2017-01-19 20:17:59 +01:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
kcov: add missing #include <linux/sched.h>
2016-12-07 17:10:00 -08:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
kexec: add restriction on kexec_load() segment sizes
2016-08-02 19:35:31 -04:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kprobes: include <asm/sections.h> instead of <asm-generic/sections.h>
2016-10-11 15:06:31 -07:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
kthread: better support freezable kthread workers
2016-10-11 15:06:33 -07:00
userns: Add per user namespace sysctls.
2016-08-08 13:18:58 -05:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm, devm_memremap_pages: hold device_hotplug lock over mem_hotplug_{begin, done}
2017-03-12 06:41:43 +01:00
Re-enable CONFIG_MODVERSIONS in a slightly weaker form
2016-11-29 16:01:30 -08:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
padata: Convert to hotplug state machine
2016-09-19 21:44:30 +02:00
x86/panic: replace smp_send_stop() with kdump friendly version in panic path
2016-10-11 15:06:32 -07:00
remove lots of IS_ERR_VALUE abuses
2016-05-27 15:26:11 -07:00
pid: fix lockdep deadlock warning due to ucount_lock
2017-01-19 20:18:03 +01:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
ptrace: Don't allow accessing an undumpable mm
2017-01-06 10:40:13 +01:00
relay: check array offset before using it
2017-01-12 11:39:30 +01:00
/proc/iomem: only expose physical resource addresses to privileged users
2016-04-14 12:56:09 -07:00
seccomp: Fix tracer exit notifications during fatal signals
2016-08-30 16:12:46 -07:00
sigaltstack: support SS_AUTODISARM for CONFIG_COMPAT
2017-03-12 06:41:44 +01:00
smp: Allocate smp_call_on_cpu() workqueue on stack too
2016-09-22 14:49:10 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
softirq: Display IRQ_POLL for irq-poll statistics
2016-10-21 15:45:47 -06:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-10-03 13:39:00 -07:00
prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable
2016-05-23 17:04:14 -07:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
sysctl: fix proc_doulongvec_ms_jiffies_minmax()
2017-02-01 08:33:05 +01:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix the length of cgroupstats_cmd_get_policy
2016-11-03 16:55:58 -04:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
kernel/...: convert pr_warning to pr_warn
2016-03-22 15:36:02 -07:00
ucount: Remove the atomicity from ucount->count
2017-03-18 19:14:29 +08:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
kernel/watchdog: use nmi registers snapshot in hardlockup handler
2017-01-06 10:40:16 +01:00
kthread: rename probe_kthread_data() to kthread_probe_data()
2016-10-11 15:06:33 -07:00
ee6f7ee1e4