[Devel] [PATCH RHEL9 COMMIT] ms/ipc/sem: do not sleep with a spin lock held

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-4.vz9.12.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-4.vz9.12.6
------>
commit 88ca42fb5144bd2fe43cc63677154727d5e9f7b1
Author: Vasily Averin <vvs at virtuozzo.com>
Date:   Wed Feb 9 13:34:05 2022 +0300

    ms/ipc/sem: do not sleep with a spin lock held
    
      We can't call kvfree() with a spin lock held, so defer it.
    
      Link: https://lkml.kernel.org/r/20211223031207.556189-1-chi.minghao@zte.com.cn
      mFixes: fc37a3b8b438 ("[PATCH] ipc sem: use kvmalloc for sem_undo allocation")
      Reported-by: Zeal Robot <zealci at zte.com.cn>
      Signed-off-by: Minghao Chi <chi.minghao at zte.com.cn>
      Reviewed-by: Shakeel Butt <shakeelb at google.com>
      Reviewed-by: Manfred Spraul <manfred at colorfullife.com>
      Cc: Arnd Bergmann <arnd at arndb.de>
      Cc: Yang Guang <cgel.zte at gmail.com>
      Cc: Davidlohr Bueso <dbueso at suse.de>
      Cc: Randy Dunlap <rdunlap at infradead.org>
      Cc: Bhaskar Chowdhury <unixbhaskar at gmail.com>
      Cc: Vasily Averin <vvs at virtuozzo.com>
      Cc: <stable at vger.kernel.org>
      Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
      Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    (cherry picked from ms commit 520ba724061cef59763e2b6f5b26e8387c2e5822)
    Signed-off-by: Vasily Averin <vvs at virtuozzo.com>
    Feature: fix ms/ipc
---
 ipc/sem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index 4c4fdf010793..863f3d32d20a 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1964,6 +1964,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
 	 */
 	un = lookup_undo(ulp, semid);
 	if (un) {
+		spin_unlock(&ulp->lock);
 		kvfree(new);
 		goto success;
 	}
@@ -1976,9 +1977,8 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid)
 	ipc_assert_locked_object(&sma->sem_perm);
 	list_add(&new->list_id, &sma->list_id);
 	un = new;
-
-success:
 	spin_unlock(&ulp->lock);
+success:
 	sem_unlock(sma, -1);
 out:
 	return un;