futex: Ensure that futex address is aligned in handle_futex_death()

[linux-2.6-microblaze.git] / kernel / futex.c

diff --git a/kernel/futex.c b/kernel/futex.c
index a0514e0..9e40cf7 100644 (file)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -68,6 +68,7 @@
 #include <linux/freezer.h>
 #include <linux/memblock.h>
 #include <linux/fault-inject.h>
+#include <linux/refcount.h>
 
 #include <asm/futex.h>
 
@@ -212,7 +213,7 @@ struct futex_pi_state {
        struct rt_mutex pi_mutex;
 
        struct task_struct *owner;
-       atomic_t refcount;
+       refcount_t refcount;
 
        union futex_key key;
 } __randomize_layout;
@@ -321,12 +322,8 @@ static int __init fail_futex_debugfs(void)
        if (IS_ERR(dir))
                return PTR_ERR(dir);
 
-       if (!debugfs_create_bool("ignore-private", mode, dir,
-                                &fail_futex.ignore_private)) {
-               debugfs_remove_recursive(dir);
-               return -ENOMEM;
-       }
-
+       debugfs_create_bool("ignore-private", mode, dir,
+                           &fail_futex.ignore_private);
        return 0;
 }
 
@@ -803,7 +800,7 @@ static int refill_pi_state_cache(void)
        INIT_LIST_HEAD(&pi_state->list);
        /* pi_mutex gets initialized later */
        pi_state->owner = NULL;
-       atomic_set(&pi_state->refcount, 1);
+       refcount_set(&pi_state->refcount, 1);
        pi_state->key = FUTEX_KEY_INIT;
 
        current->pi_state_cache = pi_state;
@@ -823,7 +820,7 @@ static struct futex_pi_state *alloc_pi_state(void)
 
 static void get_pi_state(struct futex_pi_state *pi_state)
 {
-       WARN_ON_ONCE(!atomic_inc_not_zero(&pi_state->refcount));
+       WARN_ON_ONCE(!refcount_inc_not_zero(&pi_state->refcount));
 }
 
 /*
@@ -835,7 +832,7 @@ static void put_pi_state(struct futex_pi_state *pi_state)
        if (!pi_state)
                return;
 
-       if (!atomic_dec_and_test(&pi_state->refcount))
+       if (!refcount_dec_and_test(&pi_state->refcount))
                return;
 
        /*
@@ -865,7 +862,7 @@ static void put_pi_state(struct futex_pi_state *pi_state)
                 * refcount is at 0 - put it back to 1.
                 */
                pi_state->owner = NULL;
-               atomic_set(&pi_state->refcount, 1);
+               refcount_set(&pi_state->refcount, 1);
                current->pi_state_cache = pi_state;
        }
 }
@@ -908,7 +905,7 @@ void exit_pi_state_list(struct task_struct *curr)
                 * In that case; drop the locks to let put_pi_state() make
                 * progress and retry the loop.
                 */
-               if (!atomic_inc_not_zero(&pi_state->refcount)) {
+               if (!refcount_inc_not_zero(&pi_state->refcount)) {
                        raw_spin_unlock_irq(&curr->pi_lock);
                        cpu_relax();
                        raw_spin_lock_irq(&curr->pi_lock);
@@ -1064,7 +1061,7 @@ static int attach_to_pi_state(u32 __user *uaddr, u32 uval,
         * and futex_wait_requeue_pi() as it cannot go to 0 and consequently
         * free pi_state before we can take a reference ourselves.
         */
-       WARN_ON(!atomic_read(&pi_state->refcount));
+       WARN_ON(!refcount_read(&pi_state->refcount));
 
        /*
         * Now that we have a pi_state, we can acquire wait_lock
@@ -1467,8 +1464,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
         * Queue the task for later wakeup for after we've released
         * the hb->lock. wake_q_add() grabs reference to p.
         */
-       wake_q_add(wake_q, p);
-       put_task_struct(p);
+       wake_q_add_safe(wake_q, p);
 }
 
 /*
@@ -3440,6 +3436,10 @@ static int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int p
 {
        u32 uval, uninitialized_var(nval), mval;
 
+       /* Futex address must be 32bit aligned */
+       if ((((unsigned long)uaddr) % sizeof(*uaddr)) != 0)
+               return -1;
+
 retry:
        if (get_user(uval, uaddr))
                return -1;
@@ -3823,7 +3823,7 @@ err_unlock:
 #endif /* CONFIG_COMPAT */
 
 #ifdef CONFIG_COMPAT_32BIT_TIME
-COMPAT_SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
+SYSCALL_DEFINE6(futex_time32, u32 __user *, uaddr, int, op, u32, val,
                struct old_timespec32 __user *, utime, u32 __user *, uaddr2,
                u32, val3)
 {