2 files changed, 59 insertions, 14 deletions

diff --git a/ipc/util.c b/ipc/util.c
index 03eadd8fb0fd..813804ebdeba 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -669,38 +669,81 @@ void ipc64_perm_to_ipc_perm (struct ipc64_perm *in, struct ipc_perm *out)
 }
 
 /**
+ * ipc_obtain_object
+ * @ids: ipc identifier set
+ * @id: ipc id to look for
+ *
+ * Look for an id in the ipc ids idr and return associated ipc object.
+ *
+ * Call inside the RCU critical section.
+ * The ipc object is *not* locked on exit.
+ */
+struct kern_ipc_perm *ipc_obtain_object(struct ipc_ids *ids, int id)
+{
+        struct kern_ipc_perm *out;
+        int lid = ipcid_to_idx(id);
+
+        out = idr_find(&ids->ipcs_idr, lid);
+        if (!out)
+                return ERR_PTR(-EINVAL);
+
+        return out;
+}
+
+/**
  * ipc_lock - Lock an ipc structure without rw_mutex held
  * @ids: IPC identifier set
  * @id: ipc id to look for
  *
  * Look for an id in the ipc ids idr and lock the associated ipc object.
  *
- * The ipc object is locked on exit.
+ * The ipc object is locked on successful exit.
  */
-
 struct kern_ipc_perm *ipc_lock(struct ipc_ids *ids, int id)
 {
         struct kern_ipc_perm *out;
-        int lid = ipcid_to_idx(id);
 
         rcu_read_lock();
-        out = idr_find(&ids->ipcs_idr, lid);
-        if (out == NULL) {
-                rcu_read_unlock();
-                return ERR_PTR(-EINVAL);
-        }
+        out = ipc_obtain_object(ids, id);
+        if (IS_ERR(out))
+                goto err1;
 
         spin_lock(&out->lock);
-        
+
         /* ipc_rmid() may have already freed the ID while ipc_lock
          * was spinning: here verify that the structure is still valid
          */
-        if (out->deleted) {
-                spin_unlock(&out->lock);
-                rcu_read_unlock();
-                return ERR_PTR(-EINVAL);
-        }
+        if (!out->deleted)
+                return out;
 
+        spin_unlock(&out->lock);
+        out = ERR_PTR(-EINVAL);
+err1:
+        rcu_read_unlock();
+        return out;
+}
+
+/**
+ * ipc_obtain_object_check
+ * @ids: ipc identifier set
+ * @id: ipc id to look for
+ *
+ * Similar to ipc_obtain_object() but also checks
+ * the ipc object reference counter.
+ *
+ * Call inside the RCU critical section.
+ * The ipc object is *not* locked on exit.
+ */
+struct kern_ipc_perm *ipc_obtain_object_check(struct ipc_ids *ids, int id)
+{
+        struct kern_ipc_perm *out = ipc_obtain_object(ids, id);
+
+        if (IS_ERR(out))
+                goto out;
+
+        if (ipc_checkid(out, id))
+                return ERR_PTR(-EIDRM);
+out:
         return out;
 }
 
diff --git a/ipc/util.h b/ipc/util.h
index ac1480a4efd1..bfc8d4ea6e46 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -123,6 +123,7 @@ void ipc_rcu_getref(void *ptr);
 void ipc_rcu_putref(void *ptr);
 
 struct kern_ipc_perm *ipc_lock(struct ipc_ids *, int);
+struct kern_ipc_perm *ipc_obtain_object(struct ipc_ids *ids, int id);
 
 void kernel_to_ipc64_perm(struct kern_ipc_perm *in, struct ipc64_perm *out);
 void ipc64_perm_to_ipc_perm(struct ipc64_perm *in, struct ipc_perm *out);
@@ -168,6 +169,7 @@ static inline void ipc_unlock(struct kern_ipc_perm *perm)
 }
 
 struct kern_ipc_perm *ipc_lock_check(struct ipc_ids *ids, int id);
+struct kern_ipc_perm *ipc_obtain_object_check(struct ipc_ids *ids, int id);
 int ipcget(struct ipc_namespace *ns, struct ipc_ids *ids,
                         struct ipc_ops *ops, struct ipc_params *params);
 void free_ipcs(struct ipc_namespace *ns, struct ipc_ids *ids,