Manfred Spraul 6e224f9459 ipc/sem.c: synchronize semop and semctl with IPC_RMID ... After acquiring the semlock spinlock, operations must test that the array is still valid. - semctl() and exit_sem() would walk stale linked lists (ugly, but should be ok: all lists are empty) - semtimedop() would sleep forever - and if woken up due to a signal - access memory after free. The patch also: - standardizes the tests for .deleted, so that all tests in one function leave the function with the same approach. - unconditionally tests for .deleted immediately after every call to sem_lock - even it it means that for semctl(GETALL), .deleted will be tested twice. Both changes make the review simpler: After every sem_lock, there must be a test of .deleted, followed by a goto to the cleanup code (if the function uses "goto cleanup"). The only exception is semctl_down(): If sem_ids().rwsem is locked, then the presence in ids->ipcs_idr is equivalent to !.deleted, thus no additional test is required. Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Cc: Mike Galbraith <efault@gmx.de> Acked-by: Davidlohr Bueso <davidlohr@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-10-16 21:35:52 -07:00
..
compat_mq.c
compat.c
ipc_sysctl.c
ipcns_notifier.c
Makefile
mq_sysctl.c
mqueue.c
msg.c	ipc,msg: prevent race with rmid in msgsnd,msgrcv	2013-09-30 14:31:03 -07:00
msgutil.c
namespace.c
sem.c	ipc/sem.c: synchronize semop and semctl with IPC_RMID	2013-10-16 21:35:52 -07:00
shm.c
syscall.c
util.c	ipc: update locking scheme comments	2013-10-16 21:35:52 -07:00
util.h