aboutsummaryrefslogtreecommitdiffstats
path: root/ipc/util.c
diff options
context:
space:
mode:
authorNadia Derbey <Nadia.Derbey@bull.net>2008-11-19 18:36:08 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2008-11-19 21:49:57 -0500
commite00b4ff7ebf098b11b11be403921c1cf41d9e321 (patch)
treeca0b085b803128efea92ab98723adcefb35556fc /ipc/util.c
parentcf7b9a1e11993a064f445d332fecf22819b87a5e (diff)
sysvipc: fix the ipc structures initialization
A problem was found while reviewing the code after Bugzilla bug http://bugzilla.kernel.org/show_bug.cgi?id=11796. In ipc_addid(), the newly allocated ipc structure is inserted into the ipcs tree (i.e made visible to readers) without locking it. This is not correct since its initialization continues after it has been inserted in the tree. This patch moves the ipc structure lock initialization + locking before the actual insertion. Signed-off-by: Nadia Derbey <Nadia.Derbey@bull.net> Reported-by: Clement Calmels <cboulte@gmail.com> Cc: Manfred Spraul <manfred@colorfullife.com> Cc: <stable@kernel.org> [2.6.27.x] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc/util.c')
-rw-r--r--ipc/util.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/ipc/util.c b/ipc/util.c
index 49b3ea615dc5..361fd1c96fcf 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -266,9 +266,17 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
266 if (ids->in_use >= size) 266 if (ids->in_use >= size)
267 return -ENOSPC; 267 return -ENOSPC;
268 268
269 spin_lock_init(&new->lock);
270 new->deleted = 0;
271 rcu_read_lock();
272 spin_lock(&new->lock);
273
269 err = idr_get_new(&ids->ipcs_idr, new, &id); 274 err = idr_get_new(&ids->ipcs_idr, new, &id);
270 if (err) 275 if (err) {
276 spin_unlock(&new->lock);
277 rcu_read_unlock();
271 return err; 278 return err;
279 }
272 280
273 ids->in_use++; 281 ids->in_use++;
274 282
@@ -280,10 +288,6 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
280 ids->seq = 0; 288 ids->seq = 0;
281 289
282 new->id = ipc_buildid(id, new->seq); 290 new->id = ipc_buildid(id, new->seq);
283 spin_lock_init(&new->lock);
284 new->deleted = 0;
285 rcu_read_lock();
286 spin_lock(&new->lock);
287 return id; 291 return id;
288} 292}
289 293