On 09/03/2013 10:00 AM, Manfred Spraul wrote: > The check if the queue is full and adding current to the wait queue of pending > msgsnd() operations (ss_add()) must be atomic. > > Otherwise: > - the thread that performs msgsnd() finds a full queue and decides to sleep. > - the thread that performs msgrcv() calls first reads all messages from the > queue and then sleep, because the queue is empty. > - the msgrcv() calls do not perform any wakeups, because the msgsnd() task > has not yet called ss_add(). > - then the msgsnd()-thread first calls ss_add() and then sleeps. > Net result: msgsnd() and msgrcv() both sleep forever. > > Observed with msgctl08 from ltp with a preemptible kernel. > > Fix: Call ipc_lock_object() before performing the check. > > The patch also moves security_msg_queue_msgsnd() under ipc_lock_object: > - msgctl(IPC_SET) explicitely mentions that it tries to expunge any pending > operations that are not allowed anymore with the new permissions. > If security_msg_queue_msgsnd() is called without locks, then there might be > races. > - it makes the patch much simpler. > > Reported-by: Vineet Gupta <Vineet.Gupta1@xxxxxxxxxxxx> > Signed-off-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx> Acked-by: Rik van Riel <riel@xxxxxxxxxx> -- All rights reversed -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>