Thomas Gleixner 1e38da300e timerfd: Protect the might cancel mechanism proper ... The handling of the might_cancel queueing is not properly protected, so parallel operations on the file descriptor can race with each other and lead to list corruptions or use after free. Protect the context for these operations with a seperate lock. The wait queue lock cannot be reused for this because that would create a lock inversion scenario vs. the cancel lock. Replacing might_cancel with an atomic (atomic_t or atomic bit) does not help either because it still can race vs. the actual list operation. Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: "linux-fsdevel@vger.kernel.org" Cc: syzkaller <syzkaller@googlegroups.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1701311521430.3457@nanos Signed-off-by: Thomas Gleixner <tglx@linutronix.de>		2017-02-10 11:15:09 +01:00
..
9p	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
adfs
affs
afs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
autofs4
befs	befs: add NFS export support	2016-12-22 11:25:24 +00:00
bfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
btrfs	Merge branch 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2017-01-13 17:40:22 -08:00
cachefiles
ceph	ceph: fix get_oldest_context()	2017-01-12 19:31:01 +01:00
cifs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
coda
configfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
cramfs
crypto	fscrypt: fix renaming and linking special files	2016-12-31 00:47:05 -05:00
debugfs
devpts
dlm	ktime: Get rid of ktime_equal()	2016-12-25 17:21:23 +01:00
ecryptfs
efivarfs
efs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
exofs
exportfs
ext2	ext2: Return BH_New buffers for zeroed blocks	2016-12-26 20:29:24 -08:00
ext4	ext4: Simplify DAX fault path	2016-12-26 20:29:25 -08:00
f2fs
fat
freevxfs
fscache
fuse
gfs2	ktime: Cleanup ktime_set() usage	2016-12-25 17:21:22 +01:00
hfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
hfsplus	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
hostfs
hpfs
hugetlbfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
isofs
jbd2	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
jffs2
jfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
kernfs
lockd
minix
ncpfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
nfs	ktime: Get rid of ktime_equal()	2016-12-25 17:21:23 +01:00
nfs_common
nfsd	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
nilfs2
nls
notify	Merge branch 'stable-4.10' of git://git.infradead.org/users/pcmoore/audit	2017-01-05 23:06:06 -08:00
ntfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
ocfs2	ocfs2: fix crash caused by stale lvb with fsdlm plugin	2017-01-10 18:31:54 -08:00
omfs
openpromfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
orangefs
overlayfs
proc	timers: Omit POSIX timer stuff from task_struct when disabled	2017-01-27 13:05:26 -08:00
pstore
qnx4
qnx6
quota
ramfs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
reiserfs
romfs
squashfs
sysfs
sysv
tracefs
ubifs
udf
ufs	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
xfs	xfs: Timely free truncated dirty pages	2017-01-11 10:20:04 -08:00
aio.c	ktime: Get rid of the union	2016-12-25 17:21:22 +01:00
anon_inodes.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
attr.c
bad_inode.c
binfmt_aout.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
binfmt_elf.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
binfmt_elf_fdpic.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
block_dev.c	Merge branch 'for-linus' of git://git.kernel.dk/linux-block	2017-01-04 09:03:37 -08:00
buffer.c	clean_bdev_aliases: Prevent cleaning blocks that are not in block range	2017-01-02 09:35:14 -07:00
char_dev.c
compat.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
compat_binfmt_elf.c
compat_ioctl.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
coredump.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
dax.c	dax: wrprotect pmd_t in dax_mapping_entry_mkclean	2017-01-10 18:31:54 -08:00
dcache.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
dcookies.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
exec.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
fcntl.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
fhandle.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
file.c
file_table.c
filesystems.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
fs-writeback.c
fs_pin.c
fs_struct.c
inode.c
internal.h
ioctl.c
iomap.c
Kconfig
Kconfig.binfmt
libfs.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
locks.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
Makefile
mbcache.c
mount.h
mpage.c
namei.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
namespace.c	Merge branch 'work.namespace' into for-linus	2016-12-22 23:04:31 -05:00
no-block.c
nsfs.c
open.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
pipe.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
readdir.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
select.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
seq_file.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
signalfd.c
splice.c	splice: reinstate SIGPIPE/EPIPE handling	2016-12-21 10:59:34 -08:00
stack.c
stat.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
statfs.c
super.c
sync.c
timerfd.c	timerfd: Protect the might cancel mechanism proper	2017-02-10 11:15:09 +01:00
userfaultfd.c
utimes.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00
xattr.c	Replace <asm/uaccess.h> with <linux/uaccess.h> globally	2016-12-24 11:46:01 -08:00