diff options
| author | Manfred Spraul <manfred@colorfullife.com> | 2014-12-02 15:59:34 -0800 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2015-12-06 00:49:03 +0100 |
| commit | 424d5990e894ed0e580142ccc58b9d4e3dfdd334 (patch) | |
| tree | cd790138e64c22a7cbdbbebfc68a5a7b18ea6c72 | |
| parent | 86a283d33519999a70478f20127ed1fa8af9e3bc (diff) | |
ipc/sem.c: fully initialize sem_array before making it visible
commit e8577d1f0329d4842e8302e289fb2c22156abef4 upstream.
ipc_addid() makes a new ipc identifier visible to everyone. New objects
start as locked, so that the caller can complete the initialization
after the call. Within struct sem_array, at least sma->sem_base and
sma->sem_nsems are accessed without any locks, therefore this approach
doesn't work.
Thus: Move the ipc_addid() to the end of the initialization.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Rik van Riel <riel@redhat.com>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Rafael Aquini <aquini@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 2.6.32:
- Adjust context
- The error path being moved looks a little different]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
| -rw-r--r-- | ipc/sem.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/ipc/sem.c b/ipc/sem.c index b781007eea46..26dc5b1fa64d 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -264,6 +264,12 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) return retval; } + sma->sem_base = (struct sem *) &sma[1]; + INIT_LIST_HEAD(&sma->sem_pending); + INIT_LIST_HEAD(&sma->list_id); + sma->sem_nsems = nsems; + sma->sem_ctime = get_seconds(); + id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); if (id < 0) { security_sem_free(sma); @@ -272,11 +278,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) } ns->used_sems += nsems; - sma->sem_base = (struct sem *) &sma[1]; - INIT_LIST_HEAD(&sma->sem_pending); - INIT_LIST_HEAD(&sma->list_id); - sma->sem_nsems = nsems; - sma->sem_ctime = get_seconds(); sem_unlock(sma); return sma->sem_perm.id; |