diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2006-07-10 15:44:30 +0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-07-11 00:24:18 +0400 |
| commit | 06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f (patch) | |
| tree | a98c1293470967bfa93e250b99b6a0ff129e3dee | |
| parent | bed936f7eab946c60170bc92a1aea597da158e02 (diff) | |
| download | linux-06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f.tar.xz | |
[PATCH] pi-futex: Validate futex type instead of oopsing
Calling futex_lock_pi is called with a reference to a non PI futex and
waiters exist already, lookup_pi_state() oopses due to pi_state == NULL.
Check this condition and return -EINVAL to userspace.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
| -rw-r--r-- | kernel/futex.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/futex.c b/kernel/futex.c index 1dc98e4dd287..cf0c8e21d1ab 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me) * the refcount and return its pi_state: */ pi_state = this->pi_state; + /* + * Userspace might have messed up non PI and PI futexes + */ + if (unlikely(!pi_state)) + return -EINVAL; + atomic_inc(&pi_state->refcount); me->pi_state = pi_state; |