[kernel-hardening] Re: [PATCH] shm: handle separate PID namespaces case

[Vasiliy Kulikov <segoon@openwall.com>]

On Mon, Jul 04, 2011 at 17:05 +0200, Oleg Nesterov wrote:
> On 07/04, Vasiliy Kulikov wrote:
> >
> > @@ -239,7 +239,23 @@ static int shm_try_destroy_current(int id, void *p, void *data)
> >  	if (IS_ERR(shp))
> >  		return 0;
> >
> > -	if (shp->shm_cprid != task_tgid_vnr(current)) {
> > +	if (shp->shm_creator != current) {
> > +		shm_unlock(shp);
> > +		return 0;
> 
> I know absolutely nothing about ipc/, so probably I am wrong. But do
> we really need shm_lock()

It is needed to protect against parallel reads.  To read one may just
hold shm_lock, but to write both shm_lock and rw_mutex are needed.


> (which also another idr_find)

Yes, this is a waste of time, actually.  Directly locking
->shm_perm->lock is what is needed here and in shm_try_destroy_orphaned().


Thanks for looking into this!

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments