kernel-tenderloin-3.0

Files

Manfred Spraul e73ff29041 ipc/sem.c: fix race with concurrent semtimedop() timeouts and IPC_RMID

commit d694ad62bf539dbb20a0899ac2a954555f9e4a83 upstream.

If a semaphore array is removed and in parallel a sleeping task is woken
up (signal or timeout, does not matter), then the woken up task does not
wait until wake_up_sem_queue_do() is completed.  This will cause crashes,
because wake_up_sem_queue_do() will read from a stale pointer.

The fix is simple: Regardless of anything, always call get_queue_result().
This function waits until wake_up_sem_queue_do() has finished it's task.

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=27142

Reported-by: Yuriy Yevtukhov <yuriy@ucoz.com>
Reported-by: Harald Laabs <kernel@dasr.de>
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2011-08-04 21:58:41 -07:00

compat_mq.c

ipc: initialize structure memory to zero for compat functions

2010-10-27 18:03:13 -07:00

compat.c

ipc: initialize structure memory to zero for compat functions

2010-10-27 18:03:13 -07:00

ipc_sysctl.c

sysctl ipc: Remove dead binary sysctl support code.

2009-11-12 02:04:54 -08:00

ipcns_notifier.c

ipc: do not use a negative value to re-enable msgmni automatic recomputing