Commit:     179c85ea53bef807621f335767e41e23f86f01df
Parent:     a570ab6f10462b062c28188b64377b8034235761
Author:     Arnd Bergmann <[EMAIL PROTECTED]>
AuthorDate: Tue Sep 11 15:23:49 2007 -0700
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Sep 11 17:21:20 2007 -0700

    futex_compat: fix list traversal bugs
    The futex list traversal on the compat side appears to have
    a bug.
    It's loop termination condition compares:
            while (compat_ptr(uentry) != &head->list)
    But that can't be right because "uentry" has the special
    "pi" indicator bit still potentially set at bit 0.  This
    is cleared by fetch_robust_entry() into the "entry"
    return value.
    What this seems to mean is that the list won't terminate
    when list iteration gets back to the the head.  And we'll
    also process the list head like a normal entry, which could
    cause all kinds of problems.
    So we should check for equality with "entry".  That pointer
    is of the non-compat type so we have to do a little casting
    to keep the compiler and sparse happy.
    The same problem can in theory occur with the 'pending'
    variable, although that has not been reported from users
    so far.
    Based on the original patch from David Miller.
    Acked-by: Ingo Molnar <[EMAIL PROTECTED]>
    Cc: Thomas Gleixner <[EMAIL PROTECTED]>
    Cc: David Miller <[EMAIL PROTECTED]>
    Signed-off-by: Arnd Bergmann <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 kernel/futex_compat.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index f792136..7e52eb0 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr)
        if (fetch_robust_entry(&upending, &pending,
                               &head->list_op_pending, &pip))
-       if (upending)
+       if (pending)
                handle_futex_death((void __user *)pending + futex_offset, curr, 
-       while (compat_ptr(uentry) != &head->list) {
+       while (entry != (struct robust_list __user *) &head->list) {
                 * A pending lock might already be on the list, so
                 * dont process it twice:
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to