---

yaml --- r: 180228 b: refs/heads/master c: 51246bf h: refs/heads/master v: v3
git-mirror · Feb 3, 2010 · fba6c1e · fba6c1e
1 parent 8891726
commit fba6c1e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/[refs] b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5ecb01cfdf96c5f465192bdb2a4fd4a61a24c6cc
+refs/heads/master: 51246bfd189064079c54421507236fd2723b18f3
diff --git a/trunk/kernel/futex.c b/trunk/kernel/futex.c
@@ -758,6 +758,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
 	if (!pi_state)
 		return -EINVAL;
 
+	/*
+	 * If current does not own the pi_state then the futex is
+	 * inconsistent and user space fiddled with the futex value.
+	 */
+	if (pi_state->owner != current)
+		return -EINVAL;
+
 	raw_spin_lock(&pi_state->pi_mutex.wait_lock);
 	new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);