From: Will Deacon <will.deacon@arm.com>
Date: Wed, 10 Apr 2019 10:49:11 +0000 (+0100)
Subject: arm64: futex: Avoid copying out uninitialised stack in failed cmpxchg()
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=9a53f4f87109ddb1a1a5a29d41d5e540dbafb969;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git

arm64: futex: Avoid copying out uninitialised stack in failed cmpxchg()

commit 8e4e0ac02b449297b86498ac24db5786ddd9f647 upstream.

Returning an error code from futex_atomic_cmpxchg_inatomic() indicates
that the caller should not make any use of *uval, and should instead act
upon on the value of the error code. Although this is implemented
correctly in our futex code, we needlessly copy uninitialised stack to
*uval in the error case, which can easily be avoided.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index c7e30a6ed56e..232917e9c1d9 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -134,7 +134,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *_uaddr,
 	: "memory");
 	uaccess_disable();
 
-	*uval = val;
+	if (!ret)
+		*uval = val;
+
 	return ret;
 }