3 files changed, 18 insertions, 17 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index 66c4f567eb73..1471db9a7e61 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -137,13 +137,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
                 return retval;
         }
 
-        /* ipc_addid() locks msq upon success. */
-        id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
-        if (id < 0) {
-                ipc_rcu_putref(msq, msg_rcu_free);
-                return id;
-        }
-
         msq->q_stime = msq->q_rtime = 0;
         msq->q_ctime = get_seconds();
         msq->q_cbytes = msq->q_qnum = 0;
@@ -153,6 +146,13 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
         INIT_LIST_HEAD(&msq->q_receivers);
         INIT_LIST_HEAD(&msq->q_senders);
 
+        /* ipc_addid() locks msq upon success. */
+        id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
+        if (id < 0) {
+                ipc_rcu_putref(msq, msg_rcu_free);
+                return id;
+        }
+
         ipc_unlock_object(&msq->q_perm);
         rcu_read_unlock();
 
diff --git a/ipc/shm.c b/ipc/shm.c
index 222131e8e38f..41787276e141 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -551,12 +551,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         if (IS_ERR(file))
                 goto no_file;
 
-        id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
-        if (id < 0) {
-                error = id;
-                goto no_id;
-        }
-
         shp->shm_cprid = task_tgid_vnr(current);
         shp->shm_lprid = 0;
         shp->shm_atim = shp->shm_dtim = 0;
@@ -565,6 +559,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         shp->shm_nattch = 0;
         shp->shm_file = file;
         shp->shm_creator = current;
+
+        id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+        if (id < 0) {
+                error = id;
+                goto no_id;
+        }
+
         list_add(&shp->shm_clist, &current->sysvshm.shm_clist);
 
         /*
diff --git a/ipc/util.c b/ipc/util.c
index be4230020a1f..0f401d94b7c6 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -237,6 +237,10 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
         rcu_read_lock();
         spin_lock(&new->lock);
 
+        current_euid_egid(&euid, &egid);
+        new->cuid = new->uid = euid;
+        new->gid = new->cgid = egid;
+
         id = idr_alloc(&ids->ipcs_idr, new,
                        (next_id < 0) ? 0 : ipcid_to_idx(next_id), 0,
                        GFP_NOWAIT);
@@ -249,10 +253,6 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int size)
 
         ids->in_use++;
 
-        current_euid_egid(&euid, &egid);
-        new->cuid = new->uid = euid;
-        new->gid = new->cgid = egid;
-
         if (next_id < 0) {
                 new->seq = ids->seq++;
                 if (ids->seq > IPCID_SEQ_MAX)