27.03.2013 05:51, Andrew Morton пишет:
I'm about to disappear for 1.5 weeks. Stanislav, someone, please let's get this sorted out!
Hello, Andrew. Thanks to Peter - he found where the bug is. And I believe, that his series fixes it. There is another thread, where we discussed it: https://lkml.org/lkml/2013/3/20/546 There is also my answer to Linus in this message (same thread as above): https://lkml.org/lkml/2013/4/1/80 with bug description and the small patch, which fixes the problem (in case you'd prefer it instead of reorganising the do_msgrcv()). I put the patch once more here below: ipc: set msg back to -EAGAIN if copy wasn't performed Make sure, that msg pointer is set back to error value in case of MSG_COPY flag is set and desired message to copy wasn't found. This garantees, that msg is either a error pointer or a copy address. Otherwise last message in queue will be freed without unlinking from queue (which leads to memory corruption) plus dummy allocated copy won't be released. Signed-off-by: Stanislav Kinsbursky <skinsbursky@xxxxxxxxxxxxx> diff --git a/ipc/msg.c b/ipc/msg.c index 31cd1bf..fede1d0 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -872,6 +872,7 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp, goto out_unlock; break; } + msg = ERR_PTR(-EAGAIN); } else break; msg_counter++; -- Best regards, Stanislav Kinsbursky -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html