Commit 424d5990 authored by Manfred Spraul's avatar Manfred Spraul Committed by Willy Tarreau

ipc/sem.c: fully initialize sem_array before making it visible

commit e8577d1f upstream.

ipc_addid() makes a new ipc identifier visible to everyone.  New objects
start as locked, so that the caller can complete the initialization
after the call.  Within struct sem_array, at least sma->sem_base and
sma->sem_nsems are accessed without any locks, therefore this approach
doesn't work.

Thus: Move the ipc_addid() to the end of the initialization.
Signed-off-by: default avatarManfred Spraul <manfred@colorfullife.com>
Reported-by: default avatarRik van Riel <riel@redhat.com>
Acked-by: default avatarRik van Riel <riel@redhat.com>
Acked-by: default avatarDavidlohr Bueso <dave@stgolabs.net>
Acked-by: default avatarRafael Aquini <aquini@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 2.6.32:
 - Adjust context
 - The error path being moved looks a little different]
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
parent 86a283d3
...@@ -264,6 +264,12 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) ...@@ -264,6 +264,12 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
return retval; return retval;
} }
sma->sem_base = (struct sem *) &sma[1];
INIT_LIST_HEAD(&sma->sem_pending);
INIT_LIST_HEAD(&sma->list_id);
sma->sem_nsems = nsems;
sma->sem_ctime = get_seconds();
id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni); id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
if (id < 0) { if (id < 0) {
security_sem_free(sma); security_sem_free(sma);
...@@ -272,11 +278,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params) ...@@ -272,11 +278,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
} }
ns->used_sems += nsems; ns->used_sems += nsems;
sma->sem_base = (struct sem *) &sma[1];
INIT_LIST_HEAD(&sma->sem_pending);
INIT_LIST_HEAD(&sma->list_id);
sma->sem_nsems = nsems;
sma->sem_ctime = get_seconds();
sem_unlock(sma); sem_unlock(sma);
return sma->sem_perm.id; return sma->sem_perm.id;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment