futex: Fix potential use-after-free in FUTEX_REQUEUE_PI (11a359f5) · Commits · e / devices / android_kernel_fairphone_FP3

kernel/futex.c

+11 −9

Original line number	Diff line number	Diff line
		@@ -2813,7 +2813,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
		{
		struct hrtimer_sleeper timeout, *to = NULL;
		struct rt_mutex_waiter rt_waiter;
		struct rt_mutex *pi_mutex = NULL;
		struct futex_hash_bucket *hb;
		union futex_key key2 = FUTEX_KEY_INIT;
		struct futex_q q = futex_q_init;
		@@ -2905,6 +2904,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
		spin_unlock(q.lock_ptr);
		}
		} else {
		struct rt_mutex *pi_mutex;

		/*
		* We have been woken up by futex_unlock_pi(), a timeout, or a
		* signal. futex_unlock_pi() will not destroy the lock_ptr nor
		@@ -2928,18 +2929,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
		if (res)
		ret = (res < 0) ? res : 0;

		/*
		* If fixup_pi_state_owner() faulted and was unable to handle
		* the fault, unlock the rt_mutex and return the fault to
		* userspace.
		*/
		if (ret && rt_mutex_owner(pi_mutex) == current)
		rt_mutex_unlock(pi_mutex);

		/* Unqueue and drop the lock. */
		unqueue_me_pi(&q);
		}

		/*
		* If fixup_pi_state_owner() faulted and was unable to handle the
		* fault, unlock the rt_mutex and return the fault to userspace.
		*/
		if (ret == -EFAULT) {
		if (pi_mutex && rt_mutex_owner(pi_mutex) == current)
		rt_mutex_unlock(pi_mutex);
		} else if (ret == -EINTR) {
		if (ret == -EINTR) {
		/*
		* We've already been requeued, but cannot restart by calling
		* futex_lock_pi() directly. We could restart this syscall, but