From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 4 May 2013 17:25:11 +0000 (-0700)
Subject: ipc: fix double sem unlock in semctl error path
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=fbfd1d2862a8316c7191bc551c6a842e6918abb0;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

ipc: fix double sem unlock in semctl error path

Fix another ipc locking buglet introduced by the scalability patches:
when semctl_down() was changed to delay the semaphore locking, one error
path for security_sem_semctl() went through the semaphore unlock logic
even though the semaphore had never been locked.

Introduced by commit 16df3674efe3 ("ipc,sem: do not hold ipc lock more
than necessary")

Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/ipc/sem.c b/ipc/sem.c
index 8f5aa34f8d30..1f8f01a542de 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1280,7 +1280,7 @@ static int semctl_down(struct ipc_namespace *ns, int semid,
 	err = security_sem_semctl(sma, cmd);
 	if (err) {
 		rcu_read_unlock();
-		goto out_unlock;
+		goto out_up;
 	}
 
 	switch(cmd){