]> git.karo-electronics.de Git - karo-tx-linux.git/commit
futex_compat: fix list traversal bugs
authorArnd Bergmann <arnd@arndb.de>
Tue, 11 Sep 2007 22:23:49 +0000 (15:23 -0700)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 26 Sep 2007 17:54:40 +0000 (10:54 -0700)
commit360a8cf493412bd03e5e24714f4d497d3f901926
treea6955b26f7f23a052cc82a5d4f990f7d72fd50ab
parent406d6c2a1515d7c38325cdfa4159319e3374a599
futex_compat: fix list traversal bugs

commit 179c85ea53bef807621f335767e41e23f86f01df in mainline.

The futex list traversal on the compat side appears to have
a bug.

It's loop termination condition compares:

        while (compat_ptr(uentry) != &head->list)

But that can't be right because "uentry" has the special
"pi" indicator bit still potentially set at bit 0.  This
is cleared by fetch_robust_entry() into the "entry"
return value.

What this seems to mean is that the list won't terminate
when list iteration gets back to the the head.  And we'll
also process the list head like a normal entry, which could
cause all kinds of problems.

So we should check for equality with "entry".  That pointer
is of the non-compat type so we have to do a little casting
to keep the compiler and sparse happy.

The same problem can in theory occur with the 'pending'
variable, although that has not been reported from users
so far.

Based on the original patch from David Miller.

Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
kernel/futex_compat.c