Messages in this thread | | | Date | Wed, 3 Aug 2011 22:24:17 +0400 | From | Vasiliy Kulikov <> | Subject | Re: + shm-fix-a-race-between-shm_exit-and-shm_init.patch added to -mm tree |
| |
On Wed, Aug 03, 2011 at 16:04 +0200, Oleg Nesterov wrote: > > From: Vasiliy Kulikov <segoon@openwall.com> > > > > On thread exit shm_exit_ns() is called, it uses shm_ids(ns).rw_mutex. It > > is initialized in shm_init(), but it is not called yet at the moment of > > kernel threads exit. Some kernel threads are created in > > do_pre_smp_initcalls(), and shm_init() is called in do_initcalls(). > > > > Static initialization of shm_ids(init_ipc_ns).rw_mutex fixes the race. > > Yes, it is safe to call down_right() now. > > But the code does > > down_write(rw_mutex); > if (.in_use) > idr_for_each(.ipcs_idr); > > and thus it relies on the static initializer anyway. it is not safe > to do idr_for_each() before idr_init() in theory. > > And since we rely on .in_use == 0, why we can't move this check > outside of down_write/up_right to a) optimize the code and b) > fix the problem?
Agreed. But I second Linus that partial initialization only hides the real problem. And some initcall chain movement is still needed.
-- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments
| |