linux-kernel - [PATCH] ipc/sem.c: Convert kfree_rcu() to call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201230120038.19489-1-qiang.zhang@windriver.com>
Date:   Wed, 30 Dec 2020 20:00:38 +0800
From:   qiang.zhang@...driver.com
To:     akpm@...ux-foundation.org, manfred@...orfullife.com,
        gustavoars@...nel.org
Cc:     paulmck@...nel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] ipc/sem.c: Convert kfree_rcu() to call_rcu() in freeary function

From: Zqiang <qiang.zhang@...driver.com>

Due to freeary function is called with spinlock be held,
the synchronize_rcu function may be called in kfree_rcu
function, the schedule may be happen in spinlock critical
region, need to replace kfree_rcu() with call_rcu().

Fixes: 693a8b6eecce ("ipc,rcu: Convert call_rcu(free_un) to kfree_rcu()")
Signed-off-by: Zqiang <qiang.zhang@...driver.com>
---
 ipc/sem.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index f6c30a85dadf..12c3184347d9 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1132,6 +1132,13 @@ static int count_semcnt(struct sem_array *sma, ushort semnum,
 	return semcnt;
 }
 
+static void free_un(struct rcu_head *head)
+{
+	struct sem_undo *un = container_of(head, struct sem_undo, rcu);
+
+	kfree(un);
+}
+
 /* Free a semaphore set. freeary() is called with sem_ids.rwsem locked
  * as a writer and the spinlock for this semaphore set hold. sem_ids.rwsem
  * remains locked on exit.
@@ -1152,7 +1159,7 @@ static void freeary(struct ipc_namespace *ns, struct kern_ipc_perm *ipcp)
 		un->semid = -1;
 		list_del_rcu(&un->list_proc);
 		spin_unlock(&un->ulp->lock);
-		kfree_rcu(un, rcu);
+		call_rcu(&un->rcu, free_un);
 	}
 
 	/* Wake up all pending processes and let them fail with EIDRM. */
-- 
2.17.1