From 06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f Mon Sep 17 00:00:00 2001 From: Thomas Gleixner Date: Mon, 10 Jul 2006 04:44:30 -0700 Subject: [PATCH] [PATCH] pi-futex: Validate futex type instead of oopsing Calling futex_lock_pi is called with a reference to a non PI futex and waiters exist already, lookup_pi_state() oopses due to pi_state == NULL. Check this condition and return -EINVAL to userspace. Signed-off-by: Thomas Gleixner Cc: Ingo Molnar Cc: Jakub Jelinek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/futex.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/futex.c b/kernel/futex.c index 1dc98e4dd2..cf0c8e21d1 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me) * the refcount and return its pi_state: */ pi_state = this->pi_state; + /* + * Userspace might have messed up non PI and PI futexes + */ + if (unlikely(!pi_state)) + return -EINVAL; + atomic_inc(&pi_state->refcount); me->pi_state = pi_state; -- 2.39.5