From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1751865AbcABP7B (ORCPT <rfc822;w@1wt.eu>);
	Sat, 2 Jan 2016 10:59:01 -0500
Received: from mail-wm0-f52.google.com ([74.125.82.52]:32872 "EHLO
	mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751753AbcABP64 (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Sat, 2 Jan 2016 10:58:56 -0500
Subject: Re: GPF in shm_lock ipc
To: Dmitry Vyukov <dvyukov@google.com>
References: <CACT4Y+aqaR8QYk2nyN1n1iaSZWofBEkWuffvsfcqpvmGGQyMAw@mail.gmail.com>
 <20151012122702.GC2544@node> <20151012174945.GC3170@linux-uzut.site>
 <20151012181040.GC6447@node> <20151012185533.GD3170@linux-uzut.site>
 <20151013031821.GA3052@linux-uzut.site> <20151013123028.GA12934@node>
 <CACT4Y+ZBdLqPdW+fJm=-=zJfbVFgQsgiy+eqiDTWp9rW43u+tw@mail.gmail.com>
 <20151105142336.46D907FD@black.fi.intel.com>
 <CACT4Y+bwixTW5YZjPsN7qgCbhR=HR=SMoZi9yHfBaFWdqDkoXQ@mail.gmail.com>
 <5687B576.7020303@colorfullife.com>
 <CACT4Y+YCV-dWd+RugaFPmH0uhmv7xVvqjTnr9PicH3K39bQh0g@mail.gmail.com>
Cc: syzkaller <syzkaller@googlegroups.com>,
        "Kirill A. Shutemov" <kirill@shutemov.name>,
        Andrew Morton <akpm@linux-foundation.org>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Hugh Dickins <hughd@google.com>, Joe Perches <joe@perches.com>,
        sds@tycho.nsa.gov, Oleg Nesterov <oleg@redhat.com>,
        "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        Rik van Riel <riel@redhat.com>, mhocko@suse.cz,
        gang.chen.5i5j@gmail.com, Peter Feiner <pfeiner@google.com>,
        Andrea Arcangeli <aarcange@redhat.com>,
        "linux-mm@kvack.org" <linux-mm@kvack.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>,
        Andrey Konovalov <andreyknvl@google.com>,
        Sasha Levin <sasha.levin@oracle.com>
From: Manfred Spraul <manfred@colorfullife.com>
Message-ID: <5687F3BC.9030407@colorfullife.com>
Date: Sat, 2 Jan 2016 16:58:52 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <CACT4Y+YCV-dWd+RugaFPmH0uhmv7xVvqjTnr9PicH3K39bQh0g@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Dmitry,

On 01/02/2016 01:19 PM, Dmitry Vyukov wrote:
> On Sat, Jan 2, 2016 at 12:33 PM, Manfred Spraul
> <manfred@colorfullife.com> wrote:
>> Hi Dmitry,
>>
>> shm locking differs too much from msg/sem locking, I never looked at it in
>> depth, so I'm not able to perform a proper review.
>>
>> Except for the obvious: Races that can be triggered from user space are
>> inacceptable.
>> Regardless if there is a BUG_ON, a WARN_ON or nothing at all.
>>
>> On 12/21/2015 04:44 PM, Dmitry Vyukov wrote:
>>>> +
>>>> +/* This is called by fork, once for every shm attach. */
>>>> +static void shm_open(struct vm_area_struct *vma)
>>>> +{
>>>> +       int err = __shm_open(vma);
>>>> +       /*
>>>> +        * We raced in the idr lookup or with shm_destroy().
>>>> +        * Either way, the ID is busted.
>>>> +        */
>>>> +       WARN_ON_ONCE(err);
>>>>    }
>> Is it possible to trigger this race? Parallel IPC_RMID & fork()?
> Hi Manfred,
>
> As far as I see my reproducer triggers exactly this warning (and later a crash).
Do I understand it right, shm_open() is also called by remap()?
Then please update the comment above shm_open().

And: If this is something that userspace can trigger, why a WARN_ON_ONCE()?
If the WARN_ON doesn't indicate a bug, then I would remove it entirely.

--
     Manfred