diff options
| -rw-r--r-- | kernel/futex.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/futex.c b/kernel/futex.c index 1dc98e4dd287..cf0c8e21d1ab 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -476,6 +476,12 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb, struct futex_q *me) * the refcount and return its pi_state: */ pi_state = this->pi_state; + /* + * Userspace might have messed up non PI and PI futexes + */ + if (unlikely(!pi_state)) + return -EINVAL; + atomic_inc(&pi_state->refcount); me->pi_state = pi_state; |