[PATCH] ipc/shm: check shm_lock() in do_shmat cleanup

[Yi Xie]

shm_lock() can fail; don't dereference the error pointer.

Signed-off-by: Yi Xie <xieyi@xxxxxxxxxx>
---
 ipc/shm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ipc/shm.c b/ipc/shm.c
index b3e8a58e177d..bdcf1c0f221d 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1677,6 +1677,10 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
 out_nattch:
 	down_write(&shm_ids(ns).rwsem);
 	shp = shm_lock(ns, shmid);
+	if (IS_ERR(shp)) {
+		up_write(&shm_ids(ns).rwsem);
+		return err;
+	}
 	shp->shm_nattch--;
 
 	if (shm_may_destroy(shp))
-- 
2.25.1