X-Git-Url: http://git.monstr.eu/?a=blobdiff_plain;f=kernel%2Ffutex.c;fp=kernel%2Ffutex.c;h=a1f27fd55a23212b0ff9915e23c4dde7cb274127;hb=dc7109aaa233d83b573f75763a9f1ae207042a53;hp=21625cb3e865c4f8277b04f989e017439196aab3;hpb=c49f7ece4617807c5de06857d196c825aadf60d5;p=linux-2.6-microblaze.git

diff --git a/kernel/futex.c b/kernel/futex.c
index 21625cb3e865..a1f27fd55a23 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1879,6 +1879,13 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1,
 	if (!top_waiter)
 		return 0;
 
+	/*
+	 * Ensure that this is a waiter sitting in futex_wait_requeue_pi()
+	 * and waiting on the 'waitqueue' futex which is always !PI.
+	 */
+	if (!top_waiter->rt_waiter || top_waiter->pi_state)
+		ret = -EINVAL;
+
 	/* Ensure we requeue to the expected futex. */
 	if (!match_futex(top_waiter->requeue_pi_key, key2))
 		return -EINVAL;