futex: Always cleanup owner tid in unlock_pi
authorThomas Gleixner <tglx@linutronix.de>
Tue, 3 Jun 2014 12:27:07 +0000 (12:27 +0000)
committerWilly Tarreau <w@1wt.eu>
Wed, 18 Jun 2014 22:25:59 +0000 (00:25 +0200)
commit5622af0b145d91178070b5796090c09fd427de34
treea55bb35c4f734f6e38073c31137f30f488679604
parent523b5a514d29a8fdca8c26b7e41aa7d445e4ab0d
futex: Always cleanup owner tid in unlock_pi

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex.  So the owner TID of the current owner
(the unlocker) persists.  That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e)
[wt: adjusted context - cmpxchg_futex_value_locked() takes 3 args]
Signed-off-by: Willy Tarreau <w@1wt.eu>
kernel/futex.c