From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 10 Jul 2006 11:44:30 +0000 (-0700)
Subject: [PATCH] pi-futex: Validate futex type instead of oopsing
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f;p=GitHub%2FLineageOS%2Fandroid_kernel_samsung_universal7580.git

[PATCH] pi-futex: Validate futex type instead of oopsing

Calling futex_lock_pi is called with a reference to a non PI futex and
waiters exist already, lookup_pi_state() oopses due to pi_state == NULL.
Check this condition and return -EINVAL to userspace.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Jakub Jelinek <jakub@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---

diff --git a/kernel/futex.c b/kernel/futex.c
index 1dc98e4dd28..cf0c8e21d1a 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
 			 * the refcount and return its pi_state:
 			 */
 			pi_state = this->pi_state;
+			/*
+			 * Userspace might have messed up non PI and PI futexes
+			 */
+			if (unlikely(!pi_state))
+				return -EINVAL;
+
 			atomic_inc(&pi_state->refcount);
 			me->pi_state = pi_state;