futex: futex_find_get_task remove credentails check

[net-next-2.6.git] / kernel / futex.c

diff --git a/kernel/futex.c b/kernel/futex.c
index d9b3a2228f9d8c184719ef5052f37e26b2913195..6a3a5fa1526d87d16b362e20d7d62e6809285c18 100644 (file)
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -429,20 +429,11 @@ static void free_pi_state(struct futex_pi_state *pi_state)
 static struct task_struct * futex_find_get_task(pid_t pid)
 {
        struct task_struct *p;
-       const struct cred *cred = current_cred(), *pcred;
 
        rcu_read_lock();
        p = find_task_by_vpid(pid);
-       if (!p) {
-               p = ERR_PTR(-ESRCH);
-       } else {
-               pcred = __task_cred(p);
-               if (cred->euid != pcred->euid &&
-                   cred->euid != pcred->uid)
-                       p = ERR_PTR(-ESRCH);
-               else
-                       get_task_struct(p);
-       }
+       if (p)
+               get_task_struct(p);
 
        rcu_read_unlock();
 
@@ -530,8 +521,25 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
                                return -EINVAL;
 
                        WARN_ON(!atomic_read(&pi_state->refcount));
-                       WARN_ON(pid && pi_state->owner &&
-                               pi_state->owner->pid != pid);
+
+                       /*
+                        * When pi_state->owner is NULL then the owner died
+                        * and another waiter is on the fly. pi_state->owner
+                        * is fixed up by the task which acquires
+                        * pi_state->rt_mutex.
+                        *
+                        * We do not check for pid == 0 which can happen when
+                        * the owner died and robust_list_exit() cleared the
+                        * TID.
+                        */
+                       if (pid && pi_state->owner) {
+                               /*
+                                * Bail out if user space manipulated the
+                                * futex value.
+                                */
+                               if (pid != task_pid_vnr(pi_state->owner))
+                                       return -EINVAL;
+                       }
 
                        atomic_inc(&pi_state->refcount);
                        *ps = pi_state;
@@ -547,8 +555,8 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
        if (!pid)
                return -ESRCH;
        p = futex_find_get_task(pid);
-       if (IS_ERR(p))
-               return PTR_ERR(p);
+       if (!p)
+               return -ESRCH;
 
        /*
         * We need to look at the task state flags to figure out,
@@ -758,6 +766,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
        if (!pi_state)
                return -EINVAL;
 
+       /*
+        * If current does not own the pi_state then the futex is
+        * inconsistent and user space fiddled with the futex value.
+        */
+       if (pi_state->owner != current)
+               return -EINVAL;
+
        raw_spin_lock(&pi_state->pi_mutex.wait_lock);
        new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
 
@@ -1971,7 +1986,7 @@ retry_private:
        /* Unqueue and drop the lock */
        unqueue_me_pi(&q);
 
-       goto out;
+       goto out_put_key;
 
 out_unlock_put_key:
        queue_unlock(&q, hb);