Messages in this thread | | | Date | Fri, 21 Nov 2014 15:29:27 -0500 | From | Rik van Riel <> | Subject | Re: [PATCH] ipc,sem block sem_lock on sma->lock during sma initialization |
| |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 11/21/2014 03:09 PM, Andrew Morton wrote: > On Fri, 21 Nov 2014 14:52:26 -0500 Rik van Riel <riel@redhat.com> > wrote: > >> When manipulating just one semaphore with semop, sem_lock only >> takes that single semaphore's lock. This creates a problem during >> initialization of the semaphore array, when the data structures >> used by sem_lock have not been set up yet. The sma->lock is >> already held by newary, and we just have to make sure everything >> else waits on that lock during initialization. >> >> Luckily it is easy to make sem_lock wait on the sma->lock, by >> pretending there is a complex operation in progress while the sma >> is being initialized. >> >> The newary function already zeroes sma->complex_count before >> unlocking the sma->lock. > > What are the runtime effects of the bug? >
NULL pointer dereference in spin_lock from sem_lock, if it is called before sma->sem_base has been pointed somewhere valid.
- -- All rights reversed -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQEcBAEBAgAGBQJUb6CnAAoJEM553pKExN6Dh8oH/iFVqwrukMkZp7ViFTC84DVK m8rw6CWk76kEvi6BWx977nT26e7ZfiOCxrhyy/gETOnUDJMgQrn7cFMFd6Ja/2yG uGCq5WcvVLDiLw7ij9Rqu4C6aHcICserzgfXwWV0XAa5TZOEqvg6FKZgCUHN6sxM ek0TV0oq/VQvRwAQk/MFDOv38PydH2LH1Z3wXk7JVlhEMX062a4EoxTAe8Teed2p X5+mTOl4jezog2rFJxFe0Cp8PxpqAi4f1kDugQKohZ3TpUFqH4VKZYmTtvHvpNDH oeHjnRv632N8KuU2lvIi7EGJGu0Y+ReyOr+NQtozlRYCTPuY/rezkbBmgVwu4iY= =CDvy -----END PGP SIGNATURE-----
| |