diff options
| author | Manfred Spraul <manfred@colorfullife.com> | 2014-12-03 02:59:34 +0300 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2015-04-09 14:14:24 +0300 |
| commit | dd06a9623b7e811b362f248bfc1d3886b0e8add1 (patch) | |
| tree | 0582646e8dbd6c7b6da8e0a00de3b913e487101d /ipc | |
| parent | da95a0de5c59732c942e9753ecc9c03c3783d33d (diff) | |
| download | linux-dd06a9623b7e811b362f248bfc1d3886b0e8add1.tar.xz | |
ipc/sem.c: fully initialize sem_array before making it visible
commit e8577d1f0329d4842e8302e289fb2c22156abef4 upstream.
ipc_addid() makes a new ipc identifier visible to everyone. New objects
start as locked, so that the caller can complete the initialization
after the call. Within struct sem_array, at least sma->sem_base and
sma->sem_nsems are accessed without any locks, therefore this approach
doesn't work.
Thus: Move the ipc_addid() to the end of the initialization.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Rik van Riel <riel@redhat.com>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Rafael Aquini <aquini@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'ipc')
| -rw-r--r-- | ipc/sem.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/ipc/sem.c b/ipc/sem.c index 0c312ac04e49..d8456ad6131c 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -515,13 +515,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) return retval; } - id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); - if (id < 0) { - ipc_rcu_putref(sma, sem_rcu_free); - return id; - } - ns->used_sems += nsems; - sma->sem_base = (struct sem *) &sma[1]; for (i = 0; i < nsems; i++) { @@ -536,6 +529,14 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) INIT_LIST_HEAD(&sma->list_id); sma->sem_nsems = nsems; sma->sem_ctime = get_seconds(); + + id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); + if (id < 0) { + ipc_rcu_putref(sma, sem_rcu_free); + return id; + } + ns->used_sems += nsems; + sem_unlock(sma, -1); rcu_read_unlock(); |