From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A32643F4C2 for ; Tue, 14 Jul 2026 09:30:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784021450; cv=none; b=D1qULtb98ln+K4QK2HaTJI4sUobpYJgFwKsU8cfuuhYd8QCaaGZBNVR0gETWCuVoVoHy1CTDdSQNdzj38rOATXkEEQvFMc9z5olX1xskGmSIR4k06qGIbrKeQ6m0B0W7Nlok3e2FXgyr8vLk03dW5yxe5v4pC662/FpoXHdJK6E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784021450; c=relaxed/simple; bh=S1Tqyu2owxbRKu3wf+z91BejVIAh9IWEqCNHYH5gh0E=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ky3EMGPrWvXwUVmPAh8cZk2pdI6osb/4dY2A1AfGgVMuWnJfQJUC9HSlwxhiIuEZaubyekWTBldv+sm1qG1G73uc8ZdmoJjePZ736PfuH0B0Ssafnt9ej0hejWs1/AbUA2G9dK0zFQsNfJBhIjkx0sJpQPTnC6C7bVJYa9yaU2I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gMh9eOrh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gMh9eOrh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10B9F1F00A3A; Tue, 14 Jul 2026 09:30:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784021444; bh=sK5pocFCylumuxikU6X/+EMlYULzZuF4fQP9ftHO83E=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=gMh9eOrhXUvFvTw6i/0lVDmbVz5bOteCouJa2GCl3cxS/FqpZf99Wf7nS8PadjU/G 59hax+pZm+UkGQhzPJJ0UYuNPO5aZA49z8TyXbmzvipmLPfHSjQAuoxRU5sNhQuYfR gkBlBVU5lEMVzLgoNNO13x1TbmKBHB6gzqWlc4HE2Lnl2M8LiHfBHexr1h+CCAV2RB PM0OtCKEviqUncw2CtQ2SYy5IojcaZ1Tyx1DpoAJVf4VV/+5F62ninorZej6ulDyHC CD3584GX4rhkz57dN1aG2+q/9Pc6YLxjhkidA6UE1PuF5NvqG5FH2Z3Xn+ejAC+Ssh hwU3fTMksKm7Q== Date: Tue, 14 Jul 2026 10:30:33 +0100 From: "Lorenzo Stoakes (ARM)" To: Yi Xie Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] ipc/shm: check shm_lock() in do_shmat cleanup Message-ID: References: <20260714031713.72859-1-xieyi@kylinos.cn> <20260714092237.147312-1-xieyi@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260714092237.147312-1-xieyi@kylinos.cn> Please don't send v2 in-reply-to v1 :) it makes it really hard to keep track of things. Please wait _at least_ 24 hours before sending a respin. We have far too much review load to have an immediate turnaround. Also sending out so quick doesn't make me think you've tested this :) On Tue, Jul 14, 2026 at 05:22:37PM +0800, Yi Xie wrote: > shm_lock() can fail; don't dereference the error pointer. Maybe something a bit longer, e.g.: do_shmat() calls shm_lock() in the out_nattch branch and immediately dereferences it, however shm_lock() can return an error. Check for an error and handle it if there is one. > > Signed-off-by: Yi Xie > --- > v2: keep a single up_write(), as suggested by Lorenzo > > ipc/shm.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/ipc/shm.c b/ipc/shm.c > index b3e8a58e177d..d243137c4dbd 100644 > --- a/ipc/shm.c > +++ b/ipc/shm.c > @@ -1677,12 +1677,16 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, > out_nattch: > down_write(&shm_ids(ns).rwsem); > shp = shm_lock(ns, shmid); > - shp->shm_nattch--; > + if (IS_ERR(shp)) { > + err = PTR_ERR(shp); > + } else { > + shp->shm_nattch--; > > - if (shm_may_destroy(shp)) > - shm_destroy(ns, shp); > - else > - shm_unlock(shp); > + if (shm_may_destroy(shp)) > + shm_destroy(ns, shp); > + else > + shm_unlock(shp); > + } > up_write(&shm_ids(ns).rwsem); > return err; > > -- > 2.25.1 > Cheers, Lorenzo