From 92e37d1abf63f695fda3d730dafcdf52bb9ae577 Mon Sep 17 00:00:00 2001
From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 10 Jul 2006 04:44:30 -0700
Subject: [PATCH] --- yaml --- r: 32251 b: refs/heads/master c:
 06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f h: refs/heads/master i:   32249:
 14066647bdf090f54e0c4b7096d3f5b0b0267fc4   32247:
 86dd2b0f50b98c27855e3b508cb569ccc31c3eb1 v: v3

---
 [refs]               | 2 +-
 trunk/kernel/futex.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index b499838dd509..066fb3a9a3b7 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bed936f7eab946c60170bc92a1aea597da158e02
+refs/heads/master: 06a9ec291b3aec9c7e36af0a10ad2b556bd7e84f
diff --git a/trunk/kernel/futex.c b/trunk/kernel/futex.c
index 1dc98e4dd287..cf0c8e21d1ab 100644
--- a/trunk/kernel/futex.c
+++ b/trunk/kernel/futex.c
@@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
 			 * the refcount and return its pi_state:
 			 */
 			pi_state = this->pi_state;
+			/*
+			 * Userspace might have messed up non PI and PI futexes
+			 */
+			if (unlikely(!pi_state))
+				return -EINVAL;
+
 			atomic_inc(&pi_state->refcount);
 			me->pi_state = pi_state;