Commit dc7109aa authored by Thomas Gleixner's avatar Thomas Gleixner Committed by Ingo Molnar
Browse files

futex: Validate waiter correctly in futex_proxy_trylock_atomic() 



The loop in futex_requeue() has a sanity check for the waiter, which is
missing in futex_proxy_trylock_atomic(). In theory the key2 check is
sufficient, but futexes are cursed so add it for completeness and paranoia
sake.

Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210815211305.193767519@linutronix.de
parent c49f7ece

kernel/futex.c

+7 −0
Original line number Diff line number Diff line
@@ -1879,6 +1879,13 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, 
	if (!top_waiter)

		return 0;



	/*

	 * Ensure that this is a waiter sitting in futex_wait_requeue_pi()

	 * and waiting on the 'waitqueue' futex which is always !PI.

	 */

	if (!top_waiter->rt_waiter || top_waiter->pi_state)

		ret = -EINVAL;



	/* Ensure we requeue to the expected futex. */

	if (!match_futex(top_waiter->requeue_pi_key, key2))

		return -EINVAL;