From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752597AbcG1XeP (ORCPT ); Thu, 28 Jul 2016 19:34:15 -0400 Received: from smtp2.provo.novell.com ([137.65.250.81]:45893 "EHLO smtp2.provo.novell.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752000AbcG1XeE (ORCPT ); Thu, 28 Jul 2016 19:34:04 -0400 From: Davidlohr Bueso To: akpm@linux-foundation.org Cc: manfred@colorfullife.com, bigeasy@linutronix.de, peterz@infradead.org, tglx@linutronix.de, dave@stgolabs.net, linux-kernel@vger.kernel.org, Davidlohr Bueso Subject: [PATCH 4/5] ipc/msg: Lockless security checks for msgsnd Date: Thu, 28 Jul 2016 16:33:38 -0700 Message-Id: <1469748819-19484-5-git-send-email-dave@stgolabs.net> X-Mailer: git-send-email 2.6.6 In-Reply-To: <1469748819-19484-1-git-send-email-dave@stgolabs.net> References: <1469748819-19484-1-git-send-email-dave@stgolabs.net> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Just as with msgrcv (along with the rest of sysvipc since a few years ago), perform the security checks without holding the ipc object lock. This also reduces the hogging of the lock for the entire duration of a sender, as we drop the lock upon every iteration -- and this is exactly why we also check for racing with RMID in the first place. Signed-off-by: Davidlohr Bueso --- ipc/msg.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/ipc/msg.c b/ipc/msg.c index 5181259e2ff0..fe793304dddb 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -623,14 +623,14 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, goto out_unlock1; } - ipc_lock_object(&msq->q_perm); - for (;;) { struct msg_sender s; err = -EACCES; if (ipcperms(ns, &msq->q_perm, S_IWUGO)) - goto out_unlock0; + goto out_unlock1; + + ipc_lock_object(&msq->q_perm); /* raced with RMID? */ if (!ipc_valid_object(&msq->q_perm)) { @@ -681,6 +681,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, goto out_unlock0; } + ipc_unlock_object(&msq->q_perm); } msq->q_lspid = task_tgid_vnr(current); msq->q_stime = get_seconds(); -- 2.6.6