diff options
| author | Al Viro <viro@ZenIV.linux.org.uk> | 2013-05-03 00:30:49 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-05-02 19:51:31 -0700 |
| commit | ce857229e0c3adc211944a13a5579ef84fd7b4af (patch) | |
| tree | f12310c2c6492dd7ef4b25dd0c6052f7a114b9cf /ipc | |
| parent | 20a2078ce7705a6e0722ef5184336eb8657a58d8 (diff) | |
ipc: fix GETALL/IPC_RM race for sysv semaphores
We can step on WARN_ON_ONCE() in sem_getref() if a semaphore is removed
just as we are about to call sem_getref() from semctl_main(); results
are not pretty.
We should fail with -EIDRM, same as if IPC_RM happened while we'd been
doing allocation there. This also expands sem_getref() at its only
callsite (and fixed there), while sem_getref_and_unlock() is simply
killed off - it has no callers at all.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
| -rw-r--r-- | ipc/sem.c | 29 |
1 files changed, 8 insertions, 21 deletions
diff --git a/ipc/sem.c b/ipc/sem.c index e78ee3186d1..4734e9c2a98 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -328,28 +328,12 @@ static inline void sem_lock_and_putref(struct sem_array *sma) ipc_rcu_putref(sma); } -static inline void sem_getref_and_unlock(struct sem_array *sma) -{ - WARN_ON_ONCE(!ipc_rcu_getref(sma)); - sem_unlock(sma, -1); -} - static inline void sem_putref(struct sem_array *sma) { sem_lock_and_putref(sma); sem_unlock(sma, -1); } -/* - * Call inside the rcu read section. - */ -static inline void sem_getref(struct sem_array *sma) -{ - sem_lock(sma, NULL, -1); - WARN_ON_ONCE(!ipc_rcu_getref(sma)); - sem_unlock(sma, -1); -} - static inline void sem_rmid(struct ipc_namespace *ns, struct sem_array *s) { ipc_rmid(&sem_ids(ns), &s->sem_perm); @@ -1116,9 +1100,14 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, ushort __user *array = p; int i; + sem_lock(sma, NULL, -1); if(nsems > SEMMSL_FAST) { - sem_getref(sma); - + if (!ipc_rcu_getref(sma)) { + sem_unlock(sma, -1); + err = -EIDRM; + goto out_free; + } + sem_unlock(sma, -1); sem_io = ipc_alloc(sizeof(ushort)*nsems); if(sem_io == NULL) { sem_putref(sma); @@ -1131,9 +1120,7 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, err = -EIDRM; goto out_free; } - } else - sem_lock(sma, NULL, -1); - + } for (i = 0; i < sma->sem_nsems; i++) sem_io[i] = sma->sem_base[i].semval; sem_unlock(sma, -1); |