Commit 996636dd authored Jan 16, 2015 by Michael Kerrisk Committed by Thomas Gleixner Jan 19, 2015

futex: Fix argument handling in futex_lock_pi() calls



This patch fixes two separate buglets in calls to futex_lock_pi():

  * Eliminate unused 'detect' argument
  * Change unused 'timeout' argument of FUTEX_TRYLOCK_PI to NULL

The 'detect' argument of futex_lock_pi() seems never to have been
used (when it was included with the initial PI mutex implementation
in Linux 2.6.18, all checks against its value were disabled by
ANDing against 0 (i.e., if (detect... && 0)), and with
commit 778e9a9c, any mention of
this argument in futex_lock_pi() went way altogether. Its presence
now serves only to confuse readers of the code, by giving the
impression that the futex() FUTEX_LOCK_PI operation actually does
use the 'val' argument. This patch removes the argument.

The futex_lock_pi() call that corresponds to FUTEX_TRYLOCK_PI includes
'timeout' as one of its arguments. This misleads the reader into thinking
that the FUTEX_TRYLOCK_PI operation does employ timeouts for some sensible
purpose; but it does not.  Indeed, it cannot, because the checks at the
start of sys_futex() exclude FUTEX_TRYLOCK_PI from the set of operations
that do copy_from_user() on the timeout argument. So, in the
FUTEX_TRYLOCK_PI futex_lock_pi() call it would be simplest to change
'timeout' to 'NULL'. This patch does that.

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
Reviewed-by: Darren Hart <darren@dvhart.com>
Link: http://lkml.kernel.org/r/54B96646.8010200@gmail.com


Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

parent 40a35503

kernel/futex.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -2258,7 +2258,7 @@ static long futex_wait_restart(struct restart_block *restart)
		* if there are waiters then it will block, it does PI, etc. (Due to
		* races the kernel might see a 0 value of the futex too.)
		*/
		static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, int detect,
		static int futex_lock_pi(u32 __user *uaddr, unsigned int flags,
		ktime_t *time, int trylock)
		{
		struct hrtimer_sleeper timeout, *to = NULL;
		@@ -2953,11 +2953,11 @@ long do_futex(u32 __user uaddr, int op, u32 val, ktime_t timeout,
		case FUTEX_WAKE_OP:
		return futex_wake_op(uaddr, flags, uaddr2, val, val2, val3);
		case FUTEX_LOCK_PI:
		return futex_lock_pi(uaddr, flags, val, timeout, 0);
		return futex_lock_pi(uaddr, flags, timeout, 0);
		case FUTEX_UNLOCK_PI:
		return futex_unlock_pi(uaddr, flags);
		case FUTEX_TRYLOCK_PI:
		return futex_lock_pi(uaddr, flags, 0, timeout, 1);
		return futex_lock_pi(uaddr, flags, NULL, 1);
		case FUTEX_WAIT_REQUEUE_PI:
		val3 = FUTEX_BITSET_MATCH_ANY;
		return futex_wait_requeue_pi(uaddr, flags, val, timeout, val3,

Admin message