Re: ipc: BUG: sem_unlock unlocks non-locked lock

[Davidlohr Bueso]

On Fri, 16 Dec 2016, Dmitry Vyukov wrote:

[ BUG: bad unlock balance detected! ]
4.9.0+ #89 Not tainted

Thanks for the report, I can reproduce the issue as of (which I obviously
should have tested with lockdep):

370b262c896 (ipc/sem: avoid idr tree lookup for interrupted semop)

I need to think more about it this evening, but I believe the issue to be
the potentially bogus locknum in the unlock path, as we are calling sem_lock
without updating the variable. I'll send a patch after more testing. This
fixes it for me:

diff --git a/ipc/sem.c b/ipc/sem.c
index e08b94851922..fba6139e7208 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1977,7 +1977,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf 
__user *, tsops,
                }

                rcu_read_lock();
-               sem_lock(sma, sops, nsops);
+               sem_lock(sma, sops, nsops);

                if (!ipc_valid_object(&sma->sem_perm))
                        goto out_unlock_free;

Thanks,
Davidlohr