futex_compat: fix list traversal bugs

[linux-2.6-omap-h63xx.git] / kernel / futex_compat.c

diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index f7921360efadec4d6b2e44b85adc76a19752de87..7e52eb051f227f557a171e974312d35b9192944a 100644 (file)
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -61,10 +61,10 @@ void compat_exit_robust_list(struct task_struct *curr)
        if (fetch_robust_entry(&upending, &pending,
                               &head->list_op_pending, &pip))
                return;
-       if (upending)
+       if (pending)
                handle_futex_death((void __user *)pending + futex_offset, curr, pip);
 
-       while (compat_ptr(uentry) != &head->list) {
+       while (entry != (struct robust_list __user *) &head->list) {
                /*
                 * A pending lock might already be on the list, so
                 * dont process it twice: