• Darren Hart's avatar
    futex: Fix handling of bad requeue syscall pairing · 392741e0
    Darren Hart authored
    If futex_requeue(requeue_pi=1) finds a futex_q that was created by a call
    other the futex_wait_requeue_pi(), the q.rt_waiter may be null.  If so,
    this will result in an oops from the following call graph:
    
    futex_requeue()
      rt_mutex_start_proxy_lock()
        task_blocks_on_rt_mutex()
          waiter->task dereference
            OOPS
    
    We currently WARN_ON() if this is detected, clearly this is inadequate.
    If we detect a mispairing in futex_requeue(), bail out, seding -EINVAL to
    user-space.
    
    V2: Fix parenthesis warnings.
    Signed-off-by: default avatarDarren Hart <dvhltc@us.ibm.com>
    Acked-by: default avatarPeter Zijlstra <peterz@infradead.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: John Kacur <jkacur@redhat.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Dinakar Guniguntala <dino@in.ibm.com>
    Cc: John Stultz <johnstul@linux.vnet.ibm.com>
    LKML-Reference: <4A7CA8C0.7010809@us.ibm.com>
    Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
    392741e0
futex.c 66.5 KB