Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3dd1f784 authored by Davidlohr Bueso's avatar Davidlohr Bueso Committed by Linus Torvalds
Browse files

ipc,msg: shorten critical region in msgsnd 



do_msgsnd() is another function that does too many things with the ipc
object lock acquired.  Take it only when needed when actually updating
msq.

Signed-off-by: default avatarDavidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Rik van Riel <riel@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ac0ba20e

ipc/msg.c

+24 −13
Original line number Original line Diff line number Diff line
@@ -698,10 +698,11 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, 
	msg->m_type = mtype;

	msg->m_type = mtype;

	msg->m_ts = msgsz;

	msg->m_ts = msgsz;





	msq = msg_lock_check(ns, msqid);

	rcu_read_lock();

	msq = msq_obtain_object_check(ns, msqid);

	if (IS_ERR(msq)) {

	if (IS_ERR(msq)) {

		err = PTR_ERR(msq);

		err = PTR_ERR(msq);

		goto out_free;

		goto out_unlock1;

	}

	}





	for (;;) {

	for (;;) {
@@ -709,11 +710,11 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, 




		err = -EACCES;

		err = -EACCES;

		if (ipcperms(ns, &msq->q_perm, S_IWUGO))

		if (ipcperms(ns, &msq->q_perm, S_IWUGO))

			goto out_unlock_free;

			goto out_unlock1;





		err = security_msg_queue_msgsnd(msq, msg, msgflg);

		err = security_msg_queue_msgsnd(msq, msg, msgflg);

		if (err)

		if (err)

			goto out_unlock_free;

			goto out_unlock1;





		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&

		if (msgsz + msq->q_cbytes <= msq->q_qbytes &&

				1 + msq->q_qnum <= msq->q_qbytes) {

				1 + msq->q_qnum <= msq->q_qbytes) {
@@ -723,32 +724,41 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, 
		/* queue full, wait: */

		/* queue full, wait: */

		if (msgflg & IPC_NOWAIT) {

		if (msgflg & IPC_NOWAIT) {

			err = -EAGAIN;

			err = -EAGAIN;

			goto out_unlock_free;

			goto out_unlock1;

		}

		}



		ipc_lock_object(&msq->q_perm);

		ss_add(msq, &s);

		ss_add(msq, &s);





		if (!ipc_rcu_getref(msq)) {

		if (!ipc_rcu_getref(msq)) {

			err = -EIDRM;

			err = -EIDRM;

			goto out_unlock_free;

			goto out_unlock0;

		}

		}





		msg_unlock(msq);

		ipc_unlock_object(&msq->q_perm);

		rcu_read_unlock();

		schedule();

		schedule();





		ipc_lock_by_ptr(&msq->q_perm);

		rcu_read_lock();

		ipc_lock_object(&msq->q_perm);



		ipc_rcu_putref(msq);

		ipc_rcu_putref(msq);

		if (msq->q_perm.deleted) {

		if (msq->q_perm.deleted) {

			err = -EIDRM;

			err = -EIDRM;

			goto out_unlock_free;

			goto out_unlock0;

		}

		}



		ss_del(&s);

		ss_del(&s);





		if (signal_pending(current)) {

		if (signal_pending(current)) {

			err = -ERESTARTNOHAND;

			err = -ERESTARTNOHAND;

			goto out_unlock_free;

			goto out_unlock0;

		}

		}



		ipc_unlock_object(&msq->q_perm);

	}

	}





	ipc_lock_object(&msq->q_perm);

	msq->q_lspid = task_tgid_vnr(current);

	msq->q_lspid = task_tgid_vnr(current);

	msq->q_stime = get_seconds();

	msq->q_stime = get_seconds();
@@ -764,9 +774,10 @@ long do_msgsnd(int msqid, long mtype, void __user *mtext, 
	err = 0;

	err = 0;

	msg = NULL;

	msg = NULL;





out_unlock_free:

out_unlock0:

	msg_unlock(msq);

	ipc_unlock_object(&msq->q_perm);

out_free:

out_unlock1:

	rcu_read_unlock();

	if (msg != NULL)

	if (msg != NULL)

		free_msg(msg);

		free_msg(msg);

	return err;

	return err;