From: Sonny Rao Date: Fri, 10 Jul 2009 23:13:13 +0000 (-0500) Subject: futexes: Fix infinite loop in get_futex_key() on huge page X-Git-Tag: v2.6.31-rc4~53^2 X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=ce2ae53b750abfaa012ce408e93da131a5b5649b;p=linux.git futexes: Fix infinite loop in get_futex_key() on huge page get_futex_key() can infinitely loop if it is called on a virtual address that is within a huge page but not aligned to the beginning of that page. The call to get_user_pages_fast will return the struct page for a sub-page within the huge page and the check for page->mapping will always fail. The fix is to call compound_head on the page before checking that it's mapped. Signed-off-by: Sonny Rao Acked-by: Thomas Gleixner Cc: stable@kernel.org Cc: anton@samba.org Cc: rajamony@us.ibm.com Cc: speight@us.ibm.com Cc: mstephen@us.ibm.com Cc: grimm@us.ibm.com Cc: mikey@ozlabs.au.ibm.com LKML-Reference: <20090710231313.GA23572@us.ibm.com> Signed-off-by: Ingo Molnar --- diff --git a/kernel/futex.c b/kernel/futex.c index 794c862125fe..0672ff88f159 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -247,6 +247,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw) if (err < 0) return err; + page = compound_head(page); lock_page(page); if (!page->mapping) { unlock_page(page);