Messages in this thread Patch in this message | | | Date | Mon, 14 Apr 2008 10:00:57 -0500 | From | "Serge E. Hallyn" <> | Subject | Re: [PATCH 2/2] fix sys_unshare()+SEM_UNDO: perform an implicit CLONE_SYSVSEM in CLONE_NEWIPC |
| |
Quoting Manfred Spraul (manfred@colorfullife.com): > sys_unshare(CLONE_NEWIPC) doesn't handle the undo lists properly, this can > cause a kernel memory corruption. CLONE_NEWIPC must detach from the existing > undo lists. > Fix, part 2: perform an implicit CLONE_SYSVSEM in CLONE_NEWIPC. > CLONE_NEWIPC creates a new IPC namespace, the task cannot access the > existing semaphore arrays after the unshare syscall. Thus the task > can/must detach from the existing undo list entries, too. > > This fixes the kernel corruption, because it makes it impossible that > undo records from two different namespaces are in sysvsem.undo_list.
So this was never an issue with clone(CLONE_NEWIPC|CLONE_SYSVSEM), which should have had the same result as unshare(CLONE_NEWIPC&~CLONE_SYSVSEM)?
> I'm not sure who's the right maintainer, Andrew, could you merge it? > > Signed-off-by: Manfred Spraul <manfred@colorfullife.com> > --- > kernel/fork.c | 6 +++++- > 1 files changed, 5 insertions(+), 1 deletions(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index 7f242b0..6f956a7 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -1735,9 +1735,13 @@ asmlinkage long sys_unshare(unsigned long unshare_flags) > goto bad_unshare_cleanup_semundo; > > if (new_fs || new_mm || new_fd || new_ulist || new_nsproxy) { > - if (unshare_flags & CLONE_SYSVSEM) { > + if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM)) { > /* > * CLONE_SYSVSEM is equivalent to sys_exit(). > + * > + * CLONE_NEWIPC must also detach from the undolist: after switching > + * to a new ipc namespace, the semaphore arrays from the old > + * namespace are unreachable. > */ > exit_sem(current); > } > -- > 1.5.4.1
| |