From 5ec371b75fa6109672477988216412c52805c6c4 Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Tue, 21 Oct 2003 18:23:17 -0700 Subject: [PATCH] [PATCH] ipc msg race fix Backport this fix from 2.4 --- ipc/msg.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/ipc/msg.c b/ipc/msg.c index e9f5cecfdd4cf..76c1207b8c898 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -837,11 +837,20 @@ out_success: msg_unlock(msq); schedule(); - current->state = TASK_RUNNING; + /* + * The below optimisation is buggy. A sleeping thread that is + * woken up checks if it got a message and if so, copies it to + * userspace and just returns without taking any locks. + * But this return to user space can be faster than the message + * send, and if the receiver immediately exits the + * wake_up_process performed by the sender will oops. + */ +#if 0 msg = (struct msg_msg*) msr_d.r_msg; if(!IS_ERR(msg)) goto out_success; +#endif msq = msg_lock(msqid); msg = (struct msg_msg*)msr_d.r_msg; -- 2.53.0