From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f46.google.com (mail-wm0-f46.google.com [74.125.82.46]) by kanga.kvack.org (Postfix) with ESMTP id CAF416B0003 for ; Sat, 2 Jan 2016 10:58:56 -0500 (EST) Received: by mail-wm0-f46.google.com with SMTP id l65so122955156wmf.1 for ; Sat, 02 Jan 2016 07:58:56 -0800 (PST) Received: from mail-wm0-x232.google.com (mail-wm0-x232.google.com. [2a00:1450:400c:c09::232]) by mx.google.com with ESMTPS id im4si132708810wjb.193.2016.01.02.07.58.55 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 02 Jan 2016 07:58:55 -0800 (PST) Received: by mail-wm0-x232.google.com with SMTP id l65so122954924wmf.1 for ; Sat, 02 Jan 2016 07:58:55 -0800 (PST) Subject: Re: GPF in shm_lock ipc References: <20151012122702.GC2544@node> <20151012174945.GC3170@linux-uzut.site> <20151012181040.GC6447@node> <20151012185533.GD3170@linux-uzut.site> <20151013031821.GA3052@linux-uzut.site> <20151013123028.GA12934@node> <20151105142336.46D907FD@black.fi.intel.com> <5687B576.7020303@colorfullife.com> From: Manfred Spraul Message-ID: <5687F3BC.9030407@colorfullife.com> Date: Sat, 2 Jan 2016 16:58:52 +0100 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: Dmitry Vyukov Cc: syzkaller , "Kirill A. Shutemov" , Andrew Morton , Dave Hansen , Hugh Dickins , Joe Perches , sds@tycho.nsa.gov, Oleg Nesterov , "Kirill A. Shutemov" , Rik van Riel , mhocko@suse.cz, gang.chen.5i5j@gmail.com, Peter Feiner , Andrea Arcangeli , "linux-mm@kvack.org" , LKML , Kostya Serebryany , Alexander Potapenko , Andrey Konovalov , Sasha Levin Hi Dmitry, On 01/02/2016 01:19 PM, Dmitry Vyukov wrote: > On Sat, Jan 2, 2016 at 12:33 PM, Manfred Spraul > wrote: >> Hi Dmitry, >> >> shm locking differs too much from msg/sem locking, I never looked at it in >> depth, so I'm not able to perform a proper review. >> >> Except for the obvious: Races that can be triggered from user space are >> inacceptable. >> Regardless if there is a BUG_ON, a WARN_ON or nothing at all. >> >> On 12/21/2015 04:44 PM, Dmitry Vyukov wrote: >>>> + >>>> +/* This is called by fork, once for every shm attach. */ >>>> +static void shm_open(struct vm_area_struct *vma) >>>> +{ >>>> + int err = __shm_open(vma); >>>> + /* >>>> + * We raced in the idr lookup or with shm_destroy(). >>>> + * Either way, the ID is busted. >>>> + */ >>>> + WARN_ON_ONCE(err); >>>> } >> Is it possible to trigger this race? Parallel IPC_RMID & fork()? > Hi Manfred, > > As far as I see my reproducer triggers exactly this warning (and later a crash). Do I understand it right, shm_open() is also called by remap()? Then please update the comment above shm_open(). And: If this is something that userspace can trigger, why a WARN_ON_ONCE()? If the WARN_ON doesn't indicate a bug, then I would remove it entirely. -- Manfred -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org