Messages in this thread | | | From | Alexander Mikhalitsyn <> | Subject | [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed | Date | Tue, 6 Jul 2021 16:22:57 +0300 |
| |
Hello,
Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on, then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed by exit_shm(struct task_struct *task) function. But there is a problem if task was changed IPC namespace since shmget() call. In such situation exit_shm() function will try to call shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>) which leads to the situation when sysvshm object still attached to old IPC namespace but freed; later during old IPC namespace cleanup we will try to free such sysvshm object for the second time and will get the problem :)
First patch solves this problem by postponing shm_destroy to the moment when IPC namespace cleanup will be called. Second patch is useful to prevent (or easy catch) such bugs in the future by adding corresponding WARNings.
Regards, Alex
Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Milton Miller <miltonm@bga.com> Cc: Jack Miller <millerjo@us.ibm.com> Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>
Alexander Mikhalitsyn (2): shm: skip shm_destroy if task IPC namespace was changed ipc: WARN if trying to remove ipc object which is absent
ipc/shm.c | 10 +++++++++- ipc/util.c | 6 +++--- 2 files changed, 12 insertions(+), 4 deletions(-)
-- 2.31.1
| |