All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed
@ 2021-07-06 13:22 Alexander Mikhalitsyn
  2021-07-06 13:22 ` [PATCH 1/2] shm: skip shm_destroy " Alexander Mikhalitsyn
                   ` (2 more replies)
  0 siblings, 3 replies; 17+ messages in thread
From: Alexander Mikhalitsyn @ 2021-07-06 13:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Alexander Mikhalitsyn, Andrew Morton, Milton Miller, Jack Miller,
	Pavel Tikhomirov, Alexander Mikhalitsyn

Hello,

Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace
and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on,
then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed
by exit_shm(struct task_struct *task) function. But there is a problem if task
was changed IPC namespace since shmget() call. In such situation exit_shm() function
will try to call
shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>)
which leads to the situation when sysvshm object still attached to old
IPC namespace but freed; later during old IPC namespace cleanup we will try to
free such sysvshm object for the second time and will get the problem :)

First patch solves this problem by postponing shm_destroy to the moment when
IPC namespace cleanup will be called.
Second patch is useful to prevent (or easy catch) such bugs in the future by
adding corresponding WARNings.

Regards,
Alex

Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Milton Miller <miltonm@bga.com>
Cc: Jack Miller <millerjo@us.ibm.com>
Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Cc: Alexander Mikhalitsyn <alexander@mihalicyn.com>

Alexander Mikhalitsyn (2):
  shm: skip shm_destroy if task IPC namespace was changed
  ipc: WARN if trying to remove ipc object which is absent

 ipc/shm.c  | 10 +++++++++-
 ipc/util.c |  6 +++---
 2 files changed, 12 insertions(+), 4 deletions(-)

-- 
2.31.1


^ permalink raw reply	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2021-09-24 16:45 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-06 13:22 [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed Alexander Mikhalitsyn
2021-07-06 13:22 ` [PATCH 1/2] shm: skip shm_destroy " Alexander Mikhalitsyn
2021-07-06 13:22 ` [PATCH 2/2] ipc: WARN if trying to remove ipc object which is absent Alexander Mikhalitsyn
2021-07-10  1:12 ` [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed Andrew Morton
2021-07-10 10:55   ` Alexander Mihalicyn
     [not found]     ` <CALgW_8VUk0us_umLncUv2DUMkOi3qixmT+YkHV4Dhpt_nNMZHw@mail.gmail.com>
2021-07-11 10:33       ` Alexander Mihalicyn
2021-07-11 11:46         ` Manfred Spraul
2021-07-12  9:54           ` Alexander Mihalicyn
2021-07-12 19:18             ` Eric W. Biederman
2021-07-12 19:27               ` Alexander Mihalicyn
2021-07-14 17:30                 ` [RFC PATCH] shm: extend forced shm destroy to support objects from several IPC nses Alexander Mikhalitsyn
2021-07-21  6:32                   ` Manfred Spraul
2021-07-22 18:46                   ` Manfred Spraul
2021-07-30 14:52                     ` Alexander Mihalicyn
2021-07-14 17:42                 ` [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed Alexander Mihalicyn
2021-09-23 16:36               ` Manfred Spraul
2021-09-24 16:45                 ` Eric W. Biederman

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.