Merge tag 'omap-for-v3.13/quirk-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into next/dt

From Tony Lindgren:
Changes needed to prepare for making omap3 device tree only:

- Always build in board-generic, and add pdata quirks and auxdata
  support for it so we have all the pdata related quirks
  in the same place.

- Merge of the drivers/pinctrl changes that are needed for PM
  to continue working on omap3 and also needed for other omaps
  eventually. The three pinctrl related patches have been acked
  by Linus Walleij and are pulled into both the pinctrl tree
  and this branch.

- Few defconfig related changes for drivers needed.

* tag 'omap-for-v3.13/quirk-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap: (523 commits)
  ARM: configs: omap2plus_defconfig: enable dwc3 and dependencies
  ARM: OMAP2+: Add WLAN modules and of_serial to omap2plus_defconfig
  ARM: OMAP2+: Run make savedefconfig on omap2plus_defconfig to shrink it
  ARM: OMAP2+: Add minimal 8250 support for GPMC
  ARM: OMAP2+: Use pdata quirks for wl12xx for omap3 evm and zoom3
  ARM: OMAP: Move DT wake-up event handling over to use pinctrl-single-omap
  ARM: OMAP2+: Add support for auxdata
  pinctrl: single: Add support for auxdata
  pinctrl: single: Add support for wake-up interrupts
  pinctrl: single: Prepare for supporting SoC specific features
  ARM: OMAP2+: igep0020: use display init from dss-common
  ARM: OMAP2+: pdata-quirks: add legacy display init for IGEPv2 board
  +Linux 3.12-rc4

Signed-off-by: Kevin Hilman <khilman@linaro.org>

1 files changed, 26 insertions, 6 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index b0d541d42677..558aa91186b6 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -165,6 +165,15 @@ static inline void msg_rmid(struct ipc_namespace *ns, struct msg_queue *s)
         ipc_rmid(&msg_ids(ns), &s->q_perm);
 }
 
+static void msg_rcu_free(struct rcu_head *head)
+{
+        struct ipc_rcu *p = container_of(head, struct ipc_rcu, rcu);
+        struct msg_queue *msq = ipc_rcu_to_struct(p);
+
+        security_msg_queue_free(msq);
+        ipc_rcu_free(head);
+}
+
 /**
  * newque - Create a new msg queue
  * @ns: namespace
@@ -189,15 +198,14 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
         msq->q_perm.security = NULL;
         retval = security_msg_queue_alloc(msq);
         if (retval) {
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, ipc_rcu_free);
                 return retval;
         }
 
         /* ipc_addid() locks msq upon success. */
         id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
         if (id < 0) {
-                security_msg_queue_free(msq);
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, msg_rcu_free);
                 return id;
         }
 
@@ -276,8 +284,7 @@ static void freeque(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
                 free_msg(msg);
         }
         atomic_sub(msq->q_cbytes, &ns->msg_bytes);
-        security_msg_queue_free(msq);
-        ipc_rcu_putref(msq);
+        ipc_rcu_putref(msq, msg_rcu_free);
 }
 
 /*
@@ -688,6 +695,12 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                 if (ipcperms(ns, &msq->q_perm, S_IWUGO))
                         goto out_unlock0;
 
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        err = -EIDRM;
+                        goto out_unlock0;
+                }
+
                 err = security_msg_queue_msgsnd(msq, msg, msgflg);
                 if (err)
                         goto out_unlock0;
@@ -717,7 +730,7 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext,
                 rcu_read_lock();
                 ipc_lock_object(&msq->q_perm);
 
-                ipc_rcu_putref(msq);
+                ipc_rcu_putref(msq, ipc_rcu_free);
                 if (msq->q_perm.deleted) {
                         err = -EIDRM;
                         goto out_unlock0;
@@ -894,6 +907,13 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, int msgfl
                         goto out_unlock1;
 
                 ipc_lock_object(&msq->q_perm);
+
+                /* raced with RMID? */
+                if (msq->q_perm.deleted) {
+                        msg = ERR_PTR(-EIDRM);
+                        goto out_unlock0;
+                }
+
                 msg = find_msg(msq, &msgtyp, mode);
                 if (!IS_ERR(msg)) {
                         /*