summaryrefslogtreecommitdiffstats
path: root/kernel/futex.c
diff options
context:
space:
mode:
authorThomas Gleixner <tglx@linutronix.de>2006-07-10 04:44:30 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-07-10 13:24:18 -0700
commit06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f (patch)
treea98c1293470967bfa93e250b99b6a0ff129e3dee /kernel/futex.c
parentbed936f7eab946c60170bc92a1aea597da158e02 (diff)
downloadlinux-06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f.tar.gz
linux-06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f.tar.bz2
linux-06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f.zip
[PATCH] pi-futex: Validate futex type instead of oopsing
Calling futex_lock_pi is called with a reference to a non PI futex and waiters exist already, lookup_pi_state() oopses due to pi_state == NULL. Check this condition and return -EINVAL to userspace. Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@elte.hu> Cc: Jakub Jelinek <jakub@redhat.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'kernel/futex.c')
-rw-r--r--kernel/futex.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/futex.c b/kernel/futex.c
index 1dc98e4dd287..cf0c8e21d1ab 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
* the refcount and return its pi_state:
*/
pi_state = this->pi_state;
+ /*
+ * Userspace might have messed up non PI and PI futexes
+ */
+ if (unlikely(!pi_state))
+ return -EINVAL;
+
atomic_inc(&pi_state->refcount);
me->pi_state = pi_state;