2009-04-10 16:23:40

by Darren Hart

Subject: [tip PATCH] futex: fix futex_wait_setup key handling

If the get_futex_key() call were to fail, the existing code would
try and put_futex_key() prior to returning. This patch makes sure
we only put_futex_key() if get_futex_key() succeeded.

Please apply to -rt and to tip:/core/futexes.

Reported-by: Clark Williams <[email protected]>
Signed-off-by: Darren Hart <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
---

kernel/futex.c | 5 +++--
1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/futex.c b/kernel/futex.c
index 185c981..4357f06 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1657,7 +1657,7 @@ retry_private:

ret = get_user(uval, uaddr);
if (ret)
- goto out;
+ goto out_put_key;

if (!fshared)
goto retry_private;
@@ -1671,9 +1671,10 @@ retry_private:
ret = -EWOULDBLOCK;
}

-out:
+out_put_key:
if (ret)
put_futex_key(fshared, &q->key);
+out:
return ret;
}

2009-04-10 16:34:20

by Thomas Gleixner

Subject: Re: [tip PATCH] futex: fix futex_wait_setup key handling

On Fri, 10 Apr 2009, Darren Hart wrote:

> If the get_futex_key() call were to fail, the existing code would
> try and put_futex_key() prior to returning. This patch makes sure
> we only put_futex_key() if get_futex_key() succeeded.
>
> Please apply to -rt and to tip:/core/futexes.
>
> Reported-by: Clark Williams <[email protected]>
> Signed-off-by: Darren Hart <[email protected]>
> Cc: Thomas Gleixner <[email protected]>
> Cc: Ingo Molnar <[email protected]>
> ---
>
> kernel/futex.c | 5 +++--
> 1 files changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/futex.c b/kernel/futex.c
> index 185c981..4357f06 100644
> --- a/kernel/futex.c
> +++ b/kernel/futex.c
> @@ -1657,7 +1657,7 @@ retry_private:
>
> ret = get_user(uval, uaddr);
> if (ret)
> - goto out;
> + goto out_put_key;
>
> if (!fshared)
> goto retry_private;
> @@ -1671,9 +1671,10 @@ retry_private:
> ret = -EWOULDBLOCK;
> }
>
> -out:
> +out_put_key:
> if (ret)
> put_futex_key(fshared, &q->key);
> +out:
> return ret;

Yikes. Can we please convert the places which do "goto out;" to
"return ret;" ?

Thanks,

tglx