Messages in this thread Patch in this message | | | From | Sasha Levin <> | Subject | [PATCH] ipc,sem: prevent releasing RCU read lock twice in semctl_main | Date | Sun, 31 Mar 2013 22:36:44 -0400 |
| |
We will release RCU read lock twice if the sem id passed from userspace is not within the legal range in semctl_main.
Reviewed-by: Rik van Riel <riel@redhat.com> Reviewed-by: Davidlohr Bueso <davidlohr.bueso@hp.com> Signed-off-by: Sasha Levin <sasha.levin@oracle.com> --- ipc/sem.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/ipc/sem.c b/ipc/sem.c index 6e109ef..ac36671 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -1333,8 +1333,10 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, /* GETVAL, GETPID, GETNCTN, GETZCNT: fall-through */ } err = -EINVAL; - if(semnum < 0 || semnum >= nsems) - goto out_unlock; + if(semnum < 0 || semnum >= nsems) { + rcu_read_unlock(); + goto out_wakeup; + } sem_lock(sma, NULL, -1); curr = &sma->sem_base[semnum]; -- 1.8.1.5
| |