Merge commit master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6 of HEAD

[karo-tx-linux.git] / kernel / futex.c

diff --git a/kernel/futex.c b/kernel/futex.c
index 1dc98e4dd287ec95872c7c771aab7f14e0d9ca42..cf0c8e21d1abaae85c17a816dbd42a8ed3132dd5 100644 (file)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me)
                         * the refcount and return its pi_state:
                         */
                        pi_state = this->pi_state;
+                       /*
+                        * Userspace might have messed up non PI and PI futexes
+                        */
+                       if (unlikely(!pi_state))
+                               return -EINVAL;
+
                        atomic_inc(&pi_state->refcount);
                        me->pi_state = pi_state;