3 files changed, 8 insertions, 7 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index d0c6d967b390..996feb819248 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -199,9 +199,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
                 return retval;
         }
 
-        /*
-         * ipc_addid() locks msq
-         */
+        /* ipc_addid() locks msq upon success. */
         id = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
         if (id < 0) {
                 security_msg_queue_free(msq);
@@ -218,7 +216,8 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
         INIT_LIST_HEAD(&msq->q_receivers);
         INIT_LIST_HEAD(&msq->q_senders);
 
-        msg_unlock(msq);
+        spin_unlock(&msq->q_perm.lock);
+        rcu_read_unlock();
 
         return msq->q_perm.id;
 }
diff --git a/ipc/shm.c b/ipc/shm.c
index 85dc001634b1..bd2b14ef1bba 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -535,6 +535,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         shp->shm_nattch = 0;
         shp->shm_file = file;
         shp->shm_creator = current;
+
         /*
          * shmid gets reported as "inode#" in /proc/pid/maps.
          * proc-ps tools use this. Changing this will break them.
@@ -543,7 +544,9 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
 
         ns->shm_tot += numpages;
         error = shp->shm_perm.id;
-        shm_unlock(shp);
+
+        spin_unlock(&shp->shm_perm.lock);
+        rcu_read_unlock();
         return error;
 
 no_id:
diff --git a/ipc/util.c b/ipc/util.c
index 809ec5ec8122..399821ac0a9a 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -246,9 +246,8 @@ int ipc_get_maxid(struct ipc_ids *ids)
  *      is returned. The 'new' entry is returned in a locked state on success.
  *      On failure the entry is not locked and a negative err-code is returned.
  *
- *      Called with ipc_ids.rw_mutex held as a writer.
+ *      Called with writer ipc_ids.rw_mutex held.
  */
- 
 int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
 {
         kuid_t euid;