diff options
author | Manfred Spraul <manfred@colorfullife.com> | 2008-07-25 01:48:06 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-07-25 10:53:42 -0700 |
commit | 380af1b33b3ff92df5cda96329b58f5d1b6b5a53 (patch) | |
tree | 9a47d66c18e4aae2093a708a7509c0f188ee0bd1 /include/linux/sem.h | |
parent | a1193f8ec091cd8fd309cc2982abe4499f6f2b4d (diff) | |
download | linux-stable-380af1b33b3ff92df5cda96329b58f5d1b6b5a53.tar.gz linux-stable-380af1b33b3ff92df5cda96329b58f5d1b6b5a53.tar.bz2 linux-stable-380af1b33b3ff92df5cda96329b58f5d1b6b5a53.zip |
ipc/sem.c: rewrite undo list locking
The attached patch:
- reverses the locking order of ulp->lock and sem_lock:
Previously, it was first ulp->lock, then inside sem_lock.
Now it's the other way around.
- converts the undo structure to rcu.
Benefits:
- With the old locking order, IPC_RMID could not kfree the undo structures.
The stale entries remained in the linked lists and were released later.
- The patch fixes a a race in semtimedop(): if both IPC_RMID and a semget() that
recreates exactly the same id happen between find_alloc_undo() and sem_lock,
then semtimedop() would access already kfree'd memory.
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reviewed-by: Nadia Derbey <Nadia.Derbey@bull.net>
Cc: Pierre Peiffer <peifferp@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux/sem.h')
-rw-r--r-- | include/linux/sem.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/include/linux/sem.h b/include/linux/sem.h index d42599395d79..1b191c176bcd 100644 --- a/include/linux/sem.h +++ b/include/linux/sem.h @@ -78,6 +78,7 @@ struct seminfo { #ifdef __KERNEL__ #include <asm/atomic.h> +#include <linux/rcupdate.h> struct task_struct; @@ -114,7 +115,10 @@ struct sem_queue { * when the process exits. */ struct sem_undo { - struct list_head list_proc; /* per-process list: all undos from one process */ + struct list_head list_proc; /* per-process list: all undos from one process. */ + /* rcu protected */ + struct rcu_head rcu; /* rcu struct for sem_undo() */ + struct sem_undo_list *ulp; /* sem_undo_list for the process */ struct list_head list_id; /* per semaphore array list: all undos for one array */ int semid; /* semaphore set identifier */ short * semadj; /* array of adjustments, one per semaphore */ |