4 files changed, 47 insertions, 11 deletions

diff --git a/ipc/msg.c b/ipc/msg.c
index fdf3db5731ce..ec0c724054b9 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -105,6 +105,7 @@ int msg_init_ns(struct ipc_namespace *ns)
 void msg_exit_ns(struct ipc_namespace *ns)
 {
         struct msg_queue *msq;
+        struct kern_ipc_perm *perm;
         int next_id;
         int total, in_use;
 
@@ -113,10 +114,11 @@ void msg_exit_ns(struct ipc_namespace *ns)
         in_use = msg_ids(ns).in_use;
 
         for (total = 0, next_id = 0; total < in_use; next_id++) {
-                msq = idr_find(&msg_ids(ns).ipcs_idr, next_id);
-                if (msq == NULL)
+                perm = idr_find(&msg_ids(ns).ipcs_idr, next_id);
+                if (perm == NULL)
                         continue;
-                ipc_lock_by_ptr(&msq->q_perm);
+                ipc_lock_by_ptr(perm);
+                msq = container_of(perm, struct msg_queue, q_perm);
                 freeque(ns, msq);
                 total++;
         }
@@ -144,6 +146,9 @@ static inline struct msg_queue *msg_lock_check_down(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check_down(&msg_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct msg_queue *)ipcp;
+
         return container_of(ipcp, struct msg_queue, q_perm);
 }
 
@@ -155,6 +160,9 @@ static inline struct msg_queue *msg_lock(struct ipc_namespace *ns, int id)
 {
         struct kern_ipc_perm *ipcp = ipc_lock(&msg_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct msg_queue *)ipcp;
+
         return container_of(ipcp, struct msg_queue, q_perm);
 }
 
@@ -163,6 +171,9 @@ static inline struct msg_queue *msg_lock_check(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check(&msg_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct msg_queue *)ipcp;
+
         return container_of(ipcp, struct msg_queue, q_perm);
 }
 
diff --git a/ipc/sem.c b/ipc/sem.c
index 35952c0bae46..d65e285b7e30 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -143,6 +143,7 @@ int sem_init_ns(struct ipc_namespace *ns)
 void sem_exit_ns(struct ipc_namespace *ns)
 {
         struct sem_array *sma;
+        struct kern_ipc_perm *perm;
         int next_id;
         int total, in_use;
 
@@ -151,10 +152,11 @@ void sem_exit_ns(struct ipc_namespace *ns)
         in_use = sem_ids(ns).in_use;
 
         for (total = 0, next_id = 0; total < in_use; next_id++) {
-                sma = idr_find(&sem_ids(ns).ipcs_idr, next_id);
-                if (sma == NULL)
+                perm = idr_find(&sem_ids(ns).ipcs_idr, next_id);
+                if (perm == NULL)
                         continue;
-                ipc_lock_by_ptr(&sma->sem_perm);
+                ipc_lock_by_ptr(perm);
+                sma = container_of(perm, struct sem_array, sem_perm);
                 freeary(ns, sma);
                 total++;
         }
@@ -181,6 +183,9 @@ static inline struct sem_array *sem_lock_check_down(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check_down(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -192,6 +197,9 @@ static inline struct sem_array *sem_lock(struct ipc_namespace *ns, int id)
 {
         struct kern_ipc_perm *ipcp = ipc_lock(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }
 
@@ -200,6 +208,9 @@ static inline struct sem_array *sem_lock_check(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check(&sem_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct sem_array *)ipcp;
+
         return container_of(ipcp, struct sem_array, sem_perm);
 }
 
diff --git a/ipc/shm.c b/ipc/shm.c
index 3818fae625c5..65c3a294aba5 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -111,6 +111,7 @@ int shm_init_ns(struct ipc_namespace *ns)
 void shm_exit_ns(struct ipc_namespace *ns)
 {
         struct shmid_kernel *shp;
+        struct kern_ipc_perm *perm;
         int next_id;
         int total, in_use;
 
@@ -119,10 +120,11 @@ void shm_exit_ns(struct ipc_namespace *ns)
         in_use = shm_ids(ns).in_use;
 
         for (total = 0, next_id = 0; total < in_use; next_id++) {
-                shp = idr_find(&shm_ids(ns).ipcs_idr, next_id);
-                if (shp == NULL)
+                perm = idr_find(&shm_ids(ns).ipcs_idr, next_id);
+                if (perm == NULL)
                         continue;
-                ipc_lock_by_ptr(&shp->shm_perm);
+                ipc_lock_by_ptr(perm);
+                shp = container_of(perm, struct shmid_kernel, shm_perm);
                 do_shm_rmid(ns, shp);
                 total++;
         }
@@ -149,6 +151,9 @@ static inline struct shmid_kernel *shm_lock_down(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_down(&shm_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct shmid_kernel *)ipcp;
+
         return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
 
@@ -158,6 +163,9 @@ static inline struct shmid_kernel *shm_lock_check_down(
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check_down(&shm_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct shmid_kernel *)ipcp;
+
         return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
 
@@ -169,6 +177,9 @@ static inline struct shmid_kernel *shm_lock(struct ipc_namespace *ns, int id)
 {
         struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct shmid_kernel *)ipcp;
+
         return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
 
@@ -177,6 +188,9 @@ static inline struct shmid_kernel *shm_lock_check(struct ipc_namespace *ns,
 {
         struct kern_ipc_perm *ipcp = ipc_lock_check(&shm_ids(ns), id);
 
+        if (IS_ERR(ipcp))
+                return (struct shmid_kernel *)ipcp;
+
         return container_of(ipcp, struct shmid_kernel, shm_perm);
 }
 
diff --git a/ipc/util.c b/ipc/util.c
index 1aa0ebf71bac..76c1f3461e22 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -802,8 +802,8 @@ struct ipc_proc_iter {
 /*
  * This routine locks the ipc structure found at least at position pos.
  */
-struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
-                                        loff_t *new_pos)
+static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
+                                              loff_t *new_pos)
 {
         struct kern_ipc_perm *ipc;
         int total, id;