Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] ipc/util.c: sysvipc_find_ipc() incorrectly updates
 position index
To:     Vasily Averin <vvs@virtuozzo.com>, linux-kernel@vger.kernel.org
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Andreas Schwab <schwab@suse.de>
References: <ad24ee52-21a8-3ff0-e968-63d315472b91@virtuozzo.com>
 <4921fe9b-9385-a2b4-1dc4-1099be6d2e39@virtuozzo.com>
From:   Waiman Long <longman@redhat.com>
Organization: Red Hat
Message-ID: <8e04d756-29f5-9aff-2f0b-61663ecff649@redhat.com>
Date:   Wed, 6 May 2020 11:59:59 -0400
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.4.1
MIME-Version: 1.0
In-Reply-To: <4921fe9b-9385-a2b4-1dc4-1099be6d2e39@virtuozzo.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 5/6/20 2:25 AM, Vasily Averin wrote:
> new_pos should jump through hole of unused ids,
> pos can be updated inside "for" cycle.
>
> Cc: stable@vger.kernel.org
> Fixes: 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase position index")
> Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
> ---
>   ipc/util.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/ipc/util.c b/ipc/util.c
> index 7acccfd..cfa0045 100644
> --- a/ipc/util.c
> +++ b/ipc/util.c
> @@ -764,21 +764,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos,
>   			total++;
>   	}
>   
> -	*new_pos = pos + 1;
> +	ipc = NULL;
>   	if (total >= ids->in_use)
> -		return NULL;
> +		goto out;
>   
>   	for (; pos < ipc_mni; pos++) {
>   		ipc = idr_find(&ids->ipcs_idr, pos);
>   		if (ipc != NULL) {
>   			rcu_read_lock();
>   			ipc_lock_object(ipc);
> -			return ipc;
> +			break;
>   		}
>   	}
> -
> -	/* Out of range - return NULL to terminate iteration */
> -	return NULL;
> +out:
> +	*new_pos = pos + 1;
> +	return ipc;
>   }
>   
>   static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos)

Acked-by: Waiman Long <longman@redhat.com>