ipc/shm.c: avoid ipc_rcu_putref for failed ipc_addid()
Loosely based on a patch from Kees Cook <keescook@chromium.org>: - id and error can be merged - if operations before ipc_addid() fail, then use call_rcu() directly. The difference is that call_rcu is used for failures after security_shm_alloc(), to continue to guaranteed an rcu delay for security_sem_free(). Link: http://lkml.kernel.org/r/20170525185107.12869-15-manfred@colorfullife.com Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Cc: Kees Cook <keescook@chromium.org> Cc: Davidlohr Bueso <dave@stgolabs.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
2ec55f8024
commit
a2642f8770
|
@ -548,7 +548,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
|
|||
size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
|
||||
struct file *file;
|
||||
char name[13];
|
||||
int id;
|
||||
vm_flags_t acctflag = 0;
|
||||
|
||||
if (size < SHMMIN || size > ns->shm_ctlmax)
|
||||
|
@ -617,11 +616,9 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
|
|||
shp->shm_file = file;
|
||||
shp->shm_creator = current;
|
||||
|
||||
id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
|
||||
if (id < 0) {
|
||||
error = id;
|
||||
error = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
|
||||
if (error < 0)
|
||||
goto no_id;
|
||||
}
|
||||
|
||||
list_add(&shp->shm_clist, ¤t->sysvshm.shm_clist);
|
||||
|
||||
|
@ -643,7 +640,7 @@ no_id:
|
|||
user_shm_unlock(size, shp->mlock_user);
|
||||
fput(file);
|
||||
no_file:
|
||||
ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
|
||||
call_rcu(&shp->shm_perm.rcu, shm_rcu_free);
|
||||
return error;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue