2.6.32-longterm review patch. If anyone has any objections, please let me know.
------------------ commit e8577d1f0329d4842e8302e289fb2c22156abef4 upstream. ipc_addid() makes a new ipc identifier visible to everyone. New objects start as locked, so that the caller can complete the initialization after the call. Within struct sem_array, at least sma->sem_base and sma->sem_nsems are accessed without any locks, therefore this approach doesn't work. Thus: Move the ipc_addid() to the end of the initialization. Signed-off-by: Manfred Spraul <manf...@colorfullife.com> Reported-by: Rik van Riel <r...@redhat.com> Acked-by: Rik van Riel <r...@redhat.com> Acked-by: Davidlohr Bueso <d...@stgolabs.net> Acked-by: Rafael Aquini <aqu...@redhat.com> Signed-off-by: Andrew Morton <a...@linux-foundation.org> Signed-off-by: Linus Torvalds <torva...@linux-foundation.org> [bwh: Backported to 2.6.32: - Adjust context - The error path being moved looks a little different] Signed-off-by: Ben Hutchings <b...@decadent.org.uk> Signed-off-by: Willy Tarreau <w...@1wt.eu> --- ipc/sem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/ipc/sem.c b/ipc/sem.c index b781007..26dc5b1 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -264,6 +264,12 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) return retval; } + sma->sem_base = (struct sem *) &sma[1]; + INIT_LIST_HEAD(&sma->sem_pending); + INIT_LIST_HEAD(&sma->list_id); + sma->sem_nsems = nsems; + sma->sem_ctime = get_seconds(); + id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); if (id < 0) { security_sem_free(sma); @@ -272,11 +278,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) } ns->used_sems += nsems; - sma->sem_base = (struct sem *) &sma[1]; - INIT_LIST_HEAD(&sma->sem_pending); - INIT_LIST_HEAD(&sma->list_id); - sma->sem_nsems = nsems; - sma->sem_ctime = get_seconds(); sem_unlock(sma); return sma->sem_perm.id; -- 1.7.12.2.21.g234cd45.dirty -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/