Re: [RFC PATCH 1/2] ipc: introduce obtaining a lockless ipc object

[Linus Torvalds]

On Fri, Mar 1, 2013 at 4:16 PM, Davidlohr Bueso <davidlohr.bueso@xxxxxx> wrote:
> @@ -784,7 +806,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
>         int err;
>
>         down_write(&ids->rw_mutex);
> -       ipcp = ipc_lock_check(ids, id);
> +       ipcp = ipc_obtain_object_check(ids, id);
>         if (IS_ERR(ipcp)) {
>                 err = PTR_ERR(ipcp);
>                 goto out_up;
> @@ -801,7 +823,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
>                 return ipcp;
>
>         err = -EPERM;
> -       ipc_unlock(ipcp);
> +       rcu_read_unlock();
>  out_up:
>         up_write(&ids->rw_mutex);
>         return ERR_PTR(err);

Uhhuh. This is very buggy, and I think it's the reason for the later
bugs that Emmanuel reported.

In particular, the *non-error* case is buggy, where it in the middle
of the function does

    return ipcp;

for a successful lookup.

It used to return a locked ipcp, now it no longer does. And you didn't
change any of the callers, which still do the "ipc_unlock()" at the
end.  So all the locking gets completely confused.

Oops.

                 Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/