[lkml]   [2021]   [Jul]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Subject[PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed

Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace
and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on,
then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed
by exit_shm(struct task_struct *task) function. But there is a problem if task
was changed IPC namespace since shmget() call. In such situation exit_shm() function
will try to call
shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>)
which leads to the situation when sysvshm object still attached to old
IPC namespace but freed; later during old IPC namespace cleanup we will try to
free such sysvshm object for the second time and will get the problem :)

First patch solves this problem by postponing shm_destroy to the moment when
IPC namespace cleanup will be called.
Second patch is useful to prevent (or easy catch) such bugs in the future by
adding corresponding WARNings.


Cc: Andrew Morton <>
Cc: Milton Miller <>
Cc: Jack Miller <>
Cc: Pavel Tikhomirov <>
Cc: Alexander Mikhalitsyn <>

Alexander Mikhalitsyn (2):
shm: skip shm_destroy if task IPC namespace was changed
ipc: WARN if trying to remove ipc object which is absent

ipc/shm.c | 10 +++++++++-
ipc/util.c | 6 +++---
2 files changed, 12 insertions(+), 4 deletions(-)


 \ /
  Last update: 2021-07-06 15:41    [W:1.084 / U:0.816 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site