[lkml]   [2021]   [Jul]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed
On Tue,  6 Jul 2021 16:22:57 +0300 Alexander Mikhalitsyn <> wrote:

> Hello,
> Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace
> and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on,
> then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed
> by exit_shm(struct task_struct *task) function. But there is a problem if task
> was changed IPC namespace since shmget() call. In such situation exit_shm() function
> will try to call
> shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>)
> which leads to the situation when sysvshm object still attached to old
> IPC namespace but freed; later during old IPC namespace cleanup we will try to
> free such sysvshm object for the second time and will get the problem :)
> First patch solves this problem by postponing shm_destroy to the moment when
> IPC namespace cleanup will be called.
> Second patch is useful to prevent (or easy catch) such bugs in the future by
> adding corresponding WARNings.

(cc's added)

I assume that a

Fixes: b34a6b1da371ed8af ("ipc: introduce shm_rmid_forced sysctl") is
appropriate here?

A double-free is serious. Should this fix be backported into earlier

 \ /
  Last update: 2021-07-10 03:13    [W:0.144 / U:2.356 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site