1 files changed, 12 insertions, 10 deletions

diff --git a/kernel/futex.c b/kernel/futex.c
index b766d28accd6..64c38115c7b6 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -1556,10 +1556,10 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
 
         /*
          * We are here either because we stole the rtmutex from the
-         * pending owner or we are the pending owner which failed to
-         * get the rtmutex. We have to replace the pending owner TID
-         * in the user space variable. This must be atomic as we have
-         * to preserve the owner died bit here.
+         * previous highest priority waiter or we are the highest priority
+         * waiter but failed to get the rtmutex the first time.
+         * We have to replace the newowner TID in the user space variable.
+         * This must be atomic as we have to preserve the owner died bit here.
          *
          * Note: We write the user space value _before_ changing the pi_state
          * because we can fault here. Imagine swapped out pages or a fork
@@ -1608,8 +1608,8 @@ retry:
 
         /*
          * To handle the page fault we need to drop the hash bucket
-         * lock here. That gives the other task (either the pending
-         * owner itself or the task which stole the rtmutex) the
+         * lock here. That gives the other task (either the highest priority
+         * waiter itself or the task which stole the rtmutex) the
          * chance to try the fixup of the pi_state. So once we are
          * back from handling the fault we need to check the pi_state
          * after reacquiring the hash bucket lock and before trying to
@@ -1685,18 +1685,20 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked)
                 /*
                  * pi_state is incorrect, some other task did a lock steal and
                  * we returned due to timeout or signal without taking the
-                 * rt_mutex. Too late. We can access the rt_mutex_owner without
-                 * locking, as the other task is now blocked on the hash bucket
-                 * lock. Fix the state up.
+                 * rt_mutex. Too late.
                  */
+                raw_spin_lock(&q->pi_state->pi_mutex.wait_lock);
                 owner = rt_mutex_owner(&q->pi_state->pi_mutex);
+                if (!owner)
+                        owner = rt_mutex_next_owner(&q->pi_state->pi_mutex);
+                raw_spin_unlock(&q->pi_state->pi_mutex.wait_lock);
                 ret = fixup_pi_state_owner(uaddr, q, owner);
                 goto out;
         }
 
         /*
          * Paranoia check. If we did not take the lock, then we should not be
-         * the owner, nor the pending owner, of the rt_mutex.
+         * the owner of the rt_mutex.
          */
         if (rt_mutex_owner(&q->pi_state->pi_mutex) == current)
                 printk(KERN_ERR "fixup_owner: ret = %d pi-mutex: %p "