Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2caacaa8 authored by Davidlohr Bueso's avatar Davidlohr Bueso Committed by Linus Torvalds
Browse files

ipc,shm: shorten critical region for shmctl 



With the *_INFO, *_STAT, IPC_RMID and IPC_SET commands already optimized,
deal with the remaining SHM_LOCK and SHM_UNLOCK commands.  Take the
shm_perm lock after doing the initial auditing and security checks.  The
rest of the logic remains unchanged.

Signed-off-by: default avatarDavidlohr Bueso <davidlohr.bueso@hp.com>
Tested-by: default avatarSedat Dilek <sedat.dilek@gmail.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c97cb9cc

ipc/shm.c

+25 −24
Original line number Diff line number Diff line
@@ -940,10 +940,8 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) 
	int err, version;

	struct ipc_namespace *ns;



	if (cmd < 0 || shmid < 0) {

		err = -EINVAL;

		goto out;

	}

	if (cmd < 0 || shmid < 0)

		return -EINVAL;



	version = ipc_parse_version(&cmd);

	ns = current->nsproxy->ipc_ns;
@@ -954,36 +952,40 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) 
	case SHM_STAT:

	case IPC_STAT:

		return shmctl_nolock(ns, shmid, cmd, version, buf);

	case IPC_RMID:

	case IPC_SET:

		return shmctl_down(ns, shmid, cmd, buf, version);

	case SHM_LOCK:

	case SHM_UNLOCK:

	{

		struct file *shm_file;



		shp = shm_lock_check(ns, shmid);

		rcu_read_lock();

		shp = shm_obtain_object_check(ns, shmid);

		if (IS_ERR(shp)) {

			err = PTR_ERR(shp);

			goto out;

			goto out_unlock1;

		}



		audit_ipc_obj(&(shp->shm_perm));

		err = security_shm_shmctl(shp, cmd);

		if (err)

			goto out_unlock1;



		ipc_lock_object(&shp->shm_perm);

		if (!ns_capable(ns->user_ns, CAP_IPC_LOCK)) {

			kuid_t euid = current_euid();

			err = -EPERM;

			if (!uid_eq(euid, shp->shm_perm.uid) &&

			    !uid_eq(euid, shp->shm_perm.cuid))

				goto out_unlock;

				goto out_unlock0;

			if (cmd == SHM_LOCK && !rlimit(RLIMIT_MEMLOCK))

				goto out_unlock;

				goto out_unlock0;

		}



		err = security_shm_shmctl(shp, cmd);

		if (err)

			goto out_unlock;



		shm_file = shp->shm_file;

		if (is_file_hugepages(shm_file))

			goto out_unlock;

			goto out_unlock0;



		if (cmd == SHM_LOCK) {

			struct user_struct *user = current_user();
@@ -992,32 +994,31 @@ SYSCALL_DEFINE3(shmctl, int, shmid, int, cmd, struct shmid_ds __user *, buf) 
				shp->shm_perm.mode |= SHM_LOCKED;

				shp->mlock_user = user;

			}

			goto out_unlock;

			goto out_unlock0;

		}



		/* SHM_UNLOCK */

		if (!(shp->shm_perm.mode & SHM_LOCKED))

			goto out_unlock;

			goto out_unlock0;

		shmem_lock(shm_file, 0, shp->mlock_user);

		shp->shm_perm.mode &= ~SHM_LOCKED;

		shp->mlock_user = NULL;

		get_file(shm_file);

		shm_unlock(shp);

		ipc_unlock_object(&shp->shm_perm);

		rcu_read_unlock();

		shmem_unlock_mapping(shm_file->f_mapping);



		fput(shm_file);

		goto out;

	}

	case IPC_RMID:

	case IPC_SET:

		err = shmctl_down(ns, shmid, cmd, buf, version);

		return err;

	}

	default:

		return -EINVAL;

	}



out_unlock:

	shm_unlock(shp);

out:

out_unlock0:

	ipc_unlock_object(&shp->shm_perm);

out_unlock1:

	rcu_read_unlock();

	return err;

}