futex: Always cleanup owner tid in unlock_pi
authorThomas Gleixner <tglx@linutronix.de>
Tue, 3 Jun 2014 12:27:07 +0000 (12:27 +0000)
committerBen Hutchings <ben@decadent.org.uk>
Mon, 9 Jun 2014 12:29:16 +0000 (13:29 +0100)
commitaa08027927fc73dbe938cb187859a82affa181a6
treef3ca68443e54197fa44c1c9932cbcf331bf3224a
parentcb730752b9d3ecfb2863784f14c2c997e4a90114
futex: Always cleanup owner tid in unlock_pi

commit 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e upstream.

If the owner died bit is set at futex_unlock_pi, we currently do not
cleanup the user space futex.  So the owner TID of the current owner
(the unlocker) persists.  That's observable inconsistant state,
especially when the ownership of the pi state got transferred.

Clean it up unconditionally.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Will Drewry <wad@chromium.org>
Cc: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
kernel/futex.c