Merge tag 'drm-misc-next-2017-11-30' of git://anongit.freedesktop.org/drm/drm-misc...

[linux.git] / kernel / futex.c

diff --git a/kernel/futex.c b/kernel/futex.c
index 0518a0bfc746bab4f257f2fa81ef7361f99ff113..76ed5921117a24cc347fa3aa79f59c2ba378897f 100644 (file)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -903,11 +903,27 @@ void exit_pi_state_list(struct task_struct *curr)
         */
        raw_spin_lock_irq(&curr->pi_lock);
        while (!list_empty(head)) {
-
                next = head->next;
                pi_state = list_entry(next, struct futex_pi_state, list);
                key = pi_state->key;
                hb = hash_futex(&key);
+
+               /*
+                * We can race against put_pi_state() removing itself from the
+                * list (a waiter going away). put_pi_state() will first
+                * decrement the reference count and then modify the list, so
+                * its possible to see the list entry but fail this reference
+                * acquire.
+                *
+                * In that case; drop the locks to let put_pi_state() make
+                * progress and retry the loop.
+                */
+               if (!atomic_inc_not_zero(&pi_state->refcount)) {
+                       raw_spin_unlock_irq(&curr->pi_lock);
+                       cpu_relax();
+                       raw_spin_lock_irq(&curr->pi_lock);
+                       continue;
+               }
                raw_spin_unlock_irq(&curr->pi_lock);
 
                spin_lock(&hb->lock);
@@ -918,8 +934,10 @@ void exit_pi_state_list(struct task_struct *curr)
                 * task still owns the PI-state:
                 */
                if (head->next != next) {
+                       /* retain curr->pi_lock for the loop invariant */
                        raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
                        spin_unlock(&hb->lock);
+                       put_pi_state(pi_state);
                        continue;
                }
 
@@ -927,9 +945,8 @@ void exit_pi_state_list(struct task_struct *curr)
                WARN_ON(list_empty(&pi_state->list));
                list_del_init(&pi_state->list);
                pi_state->owner = NULL;
-               raw_spin_unlock(&curr->pi_lock);
 
-               get_pi_state(pi_state);
+               raw_spin_unlock(&curr->pi_lock);
                raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock);
                spin_unlock(&hb->lock);
 
@@ -1570,8 +1587,16 @@ static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
        int oldval, ret;
 
        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
-               if (oparg < 0 || oparg > 31)
-                       return -EINVAL;
+               if (oparg < 0 || oparg > 31) {
+                       char comm[sizeof(current->comm)];
+                       /*
+                        * kill this print and return -EINVAL when userspace
+                        * is sane again
+                        */
+                       pr_info_ratelimited("futex_wake_op: %s tries to shift op by %d; fix this program\n",
+                                       get_task_comm(comm, current), oparg);
+                       oparg &= 31;
+               }
                oparg = 1 << oparg;
        }