From: Manfred Spraul <manfred@colorfullife.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Davidlohr Bueso <davidlohr@hp.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Rik van Riel <riel@redhat.com>, Mike Galbraith <efault@gmx.de>,
sedat.dilek@gmail.com,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 4/4] ipc,msg: prevent race with rmid in msgsnd,msgrcv
Date: Fri, 27 Sep 2013 07:50:44 +0200 [thread overview]
Message-ID: <52451CB4.20004@colorfullife.com> (raw)
In-Reply-To: <1379300677-24188-5-git-send-email-davidlohr@hp.com>
Hi Andrew,
Could you include the patch in -mm and push it towards Linus?
On 09/16/2013 05:04 AM, Davidlohr Bueso wrote:
> This fixes a race in both msgrcv() and msgsnd() between finding the msg and
> actually dealing with the queue, as another thread can delete shmid
> underneath us if we are preempted before acquiring the kern_ipc_perm.lock.
>
> Manfred illustrates this nicely:
>
> Assume a preemptible kernel that is preempted just after
>> msq = msq_obtain_object_check(ns, msqid)
> in do_msgrcv().
> The only lock that is held is rcu_read_lock().
>
> Now the other thread processes IPC_RMID.
> When the first task is resumed, then it will happily wait for messages on a
> deleted queue.
>
> Fix this by checking for if the queue has been deleted after taking the lock.
>
> Reported-by: Manfred Spraul <manfred@colorfullife.com>
> Cc: stable@vger.kernel.org # for 3.11
> Signed-off-by: Davidlohr Bueso <davidlohr@hp.com>
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
next prev parent reply other threads:[~2013-09-27 5:50 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-16 3:04 [PATCH 0/4] ipc: shm and msg fixes Davidlohr Bueso
2013-09-16 3:04 ` [PATCH 1/4] ipc,shm: fix race with selinux Davidlohr Bueso
2013-09-16 9:23 ` Manfred Spraul
2013-09-16 3:04 ` [PATCH 2/4] ipc,shm: prevent race with rmid in shmat(2) Davidlohr Bueso
2013-09-27 5:45 ` Manfred Spraul
2013-09-27 23:40 ` Davidlohr Bueso
2013-09-16 3:04 ` [PATCH 3/4] ipc,msg: fix race with selinux Davidlohr Bueso
2013-09-16 3:04 ` [PATCH 4/4] ipc,msg: prevent race with rmid in msgsnd,msgrcv Davidlohr Bueso
2013-09-27 5:50 ` Manfred Spraul [this message]
2013-09-19 21:22 ` [PATCH 0/4] ipc: shm and msg fixes Davidlohr Bueso
2013-09-20 18:08 ` Eric Paris
2013-09-21 18:30 ` Davidlohr Bueso
2013-09-21 18:58 ` Linus Torvalds
2013-09-23 6:42 ` Davidlohr Bueso
2013-09-23 16:54 ` Linus Torvalds
2013-09-24 0:04 ` Davidlohr Bueso
2013-09-24 1:22 ` Linus Torvalds
2013-09-24 8:49 ` Manfred Spraul
2013-09-24 9:05 ` Manfred Spraul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52451CB4.20004@colorfullife.com \
--to=manfred@colorfullife.com \
--cc=akpm@linux-foundation.org \
--cc=davidlohr@hp.com \
--cc=efault@gmx.de \
--cc=linux-kernel@vger.kernel.org \
--cc=riel@redhat.com \
--cc=sedat.dilek@gmail.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.