linux-toradex.git/ipc/sem.c, branch tegra-10.9.5

ipc ns: fix memory leak (idr)

2010-01-28T23:02:25+00:00

commit 7d6feeb287c61aafa88f06345387b1188edf4b86 upstream.

We have apparently had a memory leak since
7ca7e564e049d8b350ec9d958ff25eaa24226352 "ipc: store ipcs into IDRs" in
2007.  The idr of which 3 exist for each ipc namespace is never freed.

This patch simply frees them when the ipcns is freed.  I don't believe any
idr_remove() are done from rcu (and could therefore be delayed until after
this idr_destroy()), so the patch should be safe.  Some quick testing
showed no harm, and the memory leak fixed.

Caught by kmemleak.

Signed-off-by: Serge E. Hallyn 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Acked-by: Nick Piggin 
Signed-off-by: Greg Kroah-Hartman

rculist: use list_entry_rcu in places where it's appropriate

2009-04-15T10:05:25+00:00

Use previously introduced list_entry_rcu instead of an open-coded
list_entry + rcu_dereference combination.

Signed-off-by: Jiri Pirko 
Reviewed-by: Paul E. McKenney 
Cc: dipankar@in.ibm.com
LKML-Reference: <20090414181715.GA3634@psychotron.englab.brq.redhat.com>
Signed-off-by: Ingo Molnar

[CVE-2009-0029] System call wrappers part 25

2009-01-14T13:15:28+00:00

Signed-off-by: Heiko Carstens

[CVE-2009-0029] System call wrapper special cases

2009-01-14T13:15:18+00:00

System calls with an unsigned long long argument can't be converted with
the standard wrappers since that would include a cast to long, which in
turn means that we would lose the upper 32 bit on 32 bit architectures.
Also semctl can't use the standard wrapper since it has a 'union'
parameter.

So we handle them as special case and add some extra wrappers instead.

Signed-off-by: Heiko Carstens

ipc: do not goto to the next line

2009-01-06T23:59:29+00:00

Signed-off-by: Denis V. Lunev 
Reviewed-by: WANG Cong 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

mm: update my address

2009-01-06T01:44:42+00:00

Signed-off-by: Alan Cox 
Signed-off-by: Linus Torvalds

ipc/sem.c: make free_un() static

2008-10-16T18:21:51+00:00

Signed-off-by: Adrian Bunk 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc/sem.c: rewrite undo list locking

2008-07-25T17:53:42+00:00

The attached patch:
- reverses the locking order of ulp->lock and sem_lock:
  Previously, it was first ulp->lock, then inside sem_lock.
  Now it's the other way around.
- converts the undo structure to rcu.

Benefits:
- With the old locking order, IPC_RMID could not kfree the undo structures.
  The stale entries remained in the linked lists and were released later.
- The patch fixes a a race in semtimedop(): if both IPC_RMID and a semget() that
  recreates exactly the same id happen between find_alloc_undo() and sem_lock,
  then semtimedop() would access already kfree'd memory.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Manfred Spraul 
Reviewed-by: Nadia Derbey 
Cc: Pierre Peiffer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc/sem.c: convert sem_array.sem_pending to struct list_head

2008-07-25T17:53:42+00:00

sem_array.sem_pending is a double linked list, the attached patch converts
it to struct list_head.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Manfred Spraul 
Reviewed-by: Nadia Derbey 
Cc: Pierre Peiffer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc/sem.c: remove unused entries from struct sem_queue

2008-07-25T17:53:42+00:00

sem_queue.sma and sem_queue.id were never used, the attached patch removes
them.

Signed-off-by: Manfred Spraul 
Reviewed-by: Nadia Derbey 
Cc: Pierre Peiffer 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds