On Fri, Mar 1, 2013 at 4:16 PM, Davidlohr Bueso <davidlohr.bu...@hp.com> wrote:
> @@ -784,7 +806,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct
> ipc_namespace *ns,
> int err;
>
> down_write(&ids->rw_mutex);
> - ipcp = ipc_lock_check(ids, id);
> + ipcp = ipc_obtain_object_check(ids, id);
> if (IS_ERR(ipcp)) {
> err = PTR_ERR(ipcp);
> goto out_up;
> @@ -801,7 +823,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct
> ipc_namespace *ns,
> return ipcp;
>
> err = -EPERM;
> - ipc_unlock(ipcp);
> + rcu_read_unlock();
> out_up:
> up_write(&ids->rw_mutex);
> return ERR_PTR(err);
Uhhuh. This is very buggy, and I think it's the reason for the later
bugs that Emmanuel reported.
In particular, the *non-error* case is buggy, where it in the middle
of the function does
return ipcp;
for a successful lookup.
It used to return a locked ipcp, now it no longer does. And you didn't
change any of the callers, which still do the "ipc_unlock()" at the
end. So all the locking gets completely confused.
Oops.
Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
