Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1267330

Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in shm_mmap()

Show all headers | View raw

On Wed, 11 Nov 2015, Kirill A. Shutemov wrote:

>remap_file_pages(2) emulation can reach file which represents removed
>IPC ID as long as a memory segment is mapped. It breaks expectations
>of IPC subsystem.
>
>Test case (rewritten to be more human readable, originally autogenerated
>by syzkaller[1]):
>
>	#define _GNU_SOURCE
>	#include <stdlib.h>
>	#include <sys/ipc.h>
>	#include <sys/mman.h>
>	#include <sys/shm.h>
>
>	#define PAGE_SIZE 4096
>
>	int main()
>	{
>		int id;
>		void *p;
>
>		id = shmget(IPC_PRIVATE, 3 * PAGE_SIZE, 0);
>		p = shmat(id, NULL, 0);
>		shmctl(id, IPC_RMID, NULL);
>		remap_file_pages(p, 3 * PAGE_SIZE, 0, 7, 0);
>
>	        return 0;
>	}
>
>The patch changes shm_mmap() and code around shm_lock() to propagate
>locking error back to caller of shm_mmap().
>
>[1] http://github.com/google/syzkaller

So this is a very similar approach that I posted back when this discussion
arose: https://lkml.org/lkml/2015/10/12/959 -- There are a few differences
for which I prefer mine :)

o My shm_check_vma_validity() also deals with IPC_RMID as we do the
ipc_valid_object() check.

o We have a new WARN where necessary, instead of having one now is shm_open.

o My no-ops explicitly pair.

[...]

> 	ret = sfd->file->f_op->mmap(sfd->file, vma);
>-	if (ret != 0)
>+	if (ret) {
>+		shm_close(vma);
> 		return ret;
>+	}

Hmm what's this shm_close() about?

Thanks,
Davidlohr
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH, RESEND] ipc/shm: handle removed segments gracefully in shm_mmap() "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> - 2015-11-11 10:00 +0100
  Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() Davidlohr Bueso <dave@stgolabs.net> - 2015-11-11 18:10 +0100
    Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() "Kirill A. Shutemov" <kirill@shutemov.name> - 2015-11-11 21:00 +0100
      Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() Davidlohr Bueso <dave@stgolabs.net> - 2015-11-13 06:40 +0100
        Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() "Kirill A. Shutemov" <kirill@shutemov.name> - 2015-11-13 10:20 +0100
          Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() Davidlohr Bueso <dave@stgolabs.net> - 2015-11-13 20:30 +0100
            Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() Davidlohr Bueso <dave@stgolabs.net> - 2015-11-13 21:00 +0100
            Re: [PATCH, RESEND] ipc/shm: handle removed segments gracefully in  shm_mmap() "Kirill A. Shutemov" <kirill@shutemov.name> - 2015-11-16 10:40 +0100

csiph-web