{"push_id":655159457,"size":2,"distinct_size":2,"ref":"refs/heads/ATK","head":"834c5d106e89370d5e8cfbeea634602a74d64cc8","before":"67356856f01101baa41b08a8a4a3dde65bbdd13a","commits":[{"sha":"98bf439fd8d4c70bc1f7bbbf9e88b29da057819a","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex: Validate atomic acquisition in futex_lock_pi_atomic()\n\nWe need to protect the atomic acquisition in the kernel against rogue\nuser space which sets the user space futex to 0, so the kernel side\nacquisition succeeds while there is existing state in the kernel\nassociated to the real owner.\n\nVerify whether the futex has waiters associated with kernel state. If\nit has, return -EINVAL. The state is corrupted already, so no point in\ncleaning it up. Subsequent calls will fail as well. Not our problem.\n\n[ tglx: Use futex_top_waiter() and explain why we do not need to try\n  \trestoring the already corrupted user space state. ]\n\nSigned-off-by: Darren Hart <dvhart@linux.intel.com>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nGit-commit: 550c7910f0e2fd4f130fec2f17541f3614fdfaf9\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Ian Maund <imaund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/attack11/kernel-msm-lollipop/commits/98bf439fd8d4c70bc1f7bbbf9e88b29da057819a"},{"sha":"834c5d106e89370d5e8cfbeea634602a74d64cc8","author":{"email":"00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de","name":"Thomas Gleixner"},"message":"futex: Always cleanup owner tid in unlock_pi\n\nIf the owner died bit is set at futex_unlock_pi, we currently do not\ncleanup the user space futex. So the owner TID of the current owner\n(the unlocker) persists. That's observable inconsistant state,\nespecially when the ownership of the pi state got transferred.\n\nClean it up unconditionally.\n\nSigned-off-by: Thomas Gleixner <tglx@linutronix.de>\nCc: Kees Cook <keescook@chromium.org>\nCc: Will Drewry <wad@chromium.org>\nCc: Darren Hart <dvhart@linux.intel.com>\nCc: stable@vger.kernel.org\nGit-commit: a2ec8e3dcdc6c93f574a0e22039b791cc5e14fa6\nGit-repo: https://android.googlesource.com/kernel/common.git\nSigned-off-by: Ian Maund <imaund@codeaurora.org>","distinct":true,"url":"https://api.github.com/repos/attack11/kernel-msm-lollipop/commits/834c5d106e89370d5e8cfbeea634602a74d64cc8"}]}