Manfred Spraul c626bc46ed ipc/sem.c: fix incorrect sem_lock pairing ... Based on the syzcaller test case from dvyukov: 08d0a261fe/gistfile1.txt The slow (i.e.: failure to acquire) syscall exit from semtimedop() incorrectly assumed that the the same lock is acquired as it was at the initial syscall entry. This is wrong: - thread A: single semop semop(), sleeps - thread B: multi semop semop(), sleeps - thread A: woken up by signal/timeout With this sequence, the initial sem_lock() call locks the per-semaphore spinlock, and it is unlocked with sem_unlock(). The call at the syscall return locks the global spinlock. Because locknum is not updated, the following sem_unlock() call unlocks the per-semaphore spinlock, which is actually not locked. The fix is trivial: Use the return value from sem_lock. Fixes: 370b262c89 ("ipc/sem: avoid idr tree lookup for interrupted semop") Link: http://lkml.kernel.org/r/1482215645-22328-1-git-send-email-manfred@colorfullife.com Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Johanna Abrahamsson <johanna@mjao.org> Tested-by: Johanna Abrahamsson <johanna@mjao.org> Acked-by: Davidlohr Bueso <dave@stgolabs.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2017-01-10 18:31:55 -08:00
..
compat_mq.c
compat.c
ipc_sysctl.c
Makefile
mq_sysctl.c
mqueue.c	sched/wake_q: Rename WAKE_Q to DEFINE_WAKE_Q	2016-11-21 10:29:01 +01:00
msg.c	ipc: msg, make msgrcv work with LONG_MIN	2016-12-14 16:04:08 -08:00
msgutil.c
namespace.c
sem.c	ipc/sem.c: fix incorrect sem_lock pairing	2017-01-10 18:31:55 -08:00
shm.c	ipc/shm.c: coding style fixes	2016-12-14 16:04:08 -08:00
syscall.c
util.c
util.h