Messages in this thread Patch in this message | | | Subject | [PATCH] pi-futex: Validate futex type instead of oopsing | From | Thomas Gleixner <> | Date | Thu, 06 Jul 2006 23:59:34 +0200 |
| |
Calling futex_lock_pi is called with a reference to a non PI futex and waiters exist already, lookup_pi_state() oopses due to pi_state == NULL. Check this condition and return -EINVAL to userspace.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
diff --git a/kernel/futex.c b/kernel/futex.c index 1dc98e4..cf0c8e2 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_h * the refcount and return its pi_state: */ pi_state = this->pi_state; + /* + * Userspace might have messed up non PI and PI futexes + */ + if (unlikely(!pi_state)) + return -EINVAL; + atomic_inc(&pi_state->refcount); me->pi_state = pi_state;
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |