Messages in this thread | | | Date | Fri, 9 Jul 2021 18:12:41 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed |
| |
On Tue, 6 Jul 2021 16:22:57 +0300 Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com> wrote:
> Hello, > > Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace > and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on, > then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed > by exit_shm(struct task_struct *task) function. But there is a problem if task > was changed IPC namespace since shmget() call. In such situation exit_shm() function > will try to call > shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>) > which leads to the situation when sysvshm object still attached to old > IPC namespace but freed; later during old IPC namespace cleanup we will try to > free such sysvshm object for the second time and will get the problem :) > > First patch solves this problem by postponing shm_destroy to the moment when > IPC namespace cleanup will be called. > Second patch is useful to prevent (or easy catch) such bugs in the future by > adding corresponding WARNings. >
(cc's added)
I assume that a
Fixes: b34a6b1da371ed8af ("ipc: introduce shm_rmid_forced sysctl") is appropriate here?
A double-free is serious. Should this fix be backported into earlier kernels?
| |