From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753626AbbK2WIV (ORCPT ); Sun, 29 Nov 2015 17:08:21 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:56453 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753243AbbK2WBK (ORCPT ); Sun, 29 Nov 2015 17:01:10 -0500 Message-Id: <20151129214703.170152430@1wt.eu> User-Agent: quilt/0.63-1 Date: Sun, 29 Nov 2015 22:47:09 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Manfred Spraul , Rik van Riel , Davidlohr Bueso , Rafael Aquini , Andrew Morton , Linus Torvalds , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 07/38] [PATCH 07/38] ipc/sem.c: fully initialize sem_array before making it visible MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <8acf8256ccc72771a80b7851061027bc@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ commit e8577d1f0329d4842e8302e289fb2c22156abef4 upstream. ipc_addid() makes a new ipc identifier visible to everyone. New objects start as locked, so that the caller can complete the initialization after the call. Within struct sem_array, at least sma->sem_base and sma->sem_nsems are accessed without any locks, therefore this approach doesn't work. Thus: Move the ipc_addid() to the end of the initialization. Signed-off-by: Manfred Spraul Reported-by: Rik van Riel Acked-by: Rik van Riel Acked-by: Davidlohr Bueso Acked-by: Rafael Aquini Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds [bwh: Backported to 2.6.32: - Adjust context - The error path being moved looks a little different] Signed-off-by: Ben Hutchings Signed-off-by: Willy Tarreau --- ipc/sem.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/ipc/sem.c b/ipc/sem.c index b781007..26dc5b1 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -264,6 +264,12 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) return retval; } + sma->sem_base = (struct sem *) &sma[1]; + INIT_LIST_HEAD(&sma->sem_pending); + INIT_LIST_HEAD(&sma->list_id); + sma->sem_nsems = nsems; + sma->sem_ctime = get_seconds(); + id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); if (id < 0) { security_sem_free(sma); @@ -272,11 +278,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) } ns->used_sems += nsems; - sma->sem_base = (struct sem *) &sma[1]; - INIT_LIST_HEAD(&sma->sem_pending); - INIT_LIST_HEAD(&sma->list_id); - sma->sem_nsems = nsems; - sma->sem_ctime = get_seconds(); sem_unlock(sma); return sma->sem_perm.id; -- 1.7.12.2.21.g234cd45.dirty