lkml.org 
[lkml]   [2012]   [Jul]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectpotential NULL dereference in futex_wait_requeue_pi()
Hi Darren,

The patch 52400ba94675: "futex: add requeue_pi functionality" from
Apr 3, 2009, leads to the following warning:
kernel/futex.c:2373 futex_wait_requeue_pi()
error: potential NULL dereference 'pi_mutex'.

2330 if (!q.rt_waiter) {
2331 /*
2332 * Got the lock. We might not be the anticipated owner if we
2333 * did a lock-steal - fix up the PI-state in that case.
2334 */
2335 if (q.pi_state && (q.pi_state->owner != current)) {
2336 spin_lock(q.lock_ptr);
2337 ret = fixup_pi_state_owner(uaddr2, &q, current);

pi_mutex is NULL here and it looks like fixup_pi_state_owner() can
return -EFAULT.

2338 spin_unlock(q.lock_ptr);
2339 }
2340 } else {

[snipped]

2366 }
2367
2368 /*
2369 * If fixup_pi_state_owner() faulted and was unable to handle the
2370 * fault, unlock the rt_mutex and return the fault to userspace.
2371 */
2372 if (ret == -EFAULT) {
2373 if (rt_mutex_owner(pi_mutex) == current)
^^^^^^^^
This will oops if pi_mutex is NULL.

2374 rt_mutex_unlock(pi_mutex);
2375 } else if (ret == -EINTR) {

regards,
dan carpenter



\
 
 \ /
  Last update: 2012-07-18 17:01    [W:0.093 / U:0.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site