From 8512d645e6ba37e6b00320617b8879c502e5eb31 Mon Sep 17 00:00:00 2001 From: Davidlohr Bueso Date: Fri, 19 Apr 2013 22:34:19 +0200 Subject: [PATCH 3/4] ipc, sem: do not call sem_lock when bogus sma In exit_sem() we attempt to acquire the sma->sem_perm.lock by calling sem_lock() immediately after obtaining sma. However, if sma isn't valid, then calling sem_lock() will tend to do bad things. Move the sma error check right after the sem_obtain_object_check() call instead. Signed-off-by: Davidlohr Bueso --- ipc/sem.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ipc/sem.c b/ipc/sem.c index 926c4b7..acada9f 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1872,8 +1872,7 @@ void exit_sem(struct task_struct *tsk) struct sem_array *sma; struct sem_undo *un; struct list_head tasks; - int semid; - int i; + int semid, i; rcu_read_lock(); un = list_entry_rcu(ulp->list_proc.next, @@ -1889,12 +1888,13 @@ void exit_sem(struct task_struct *tsk) } sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid); - sem_lock(sma, NULL, -1); - /* exit_sem raced with IPC_RMID, nothing to do */ - if (IS_ERR(sma)) + if (IS_ERR(sma)) { + rcu_read_unlock(); continue; + } + sem_lock(sma, NULL, -1); un = __lookup_undo(ulp, semid); if (un == NULL) { /* exit_sem raced with IPC_RMID+semget() that created -- 1.8.2.1