From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B25C175A6C for ; Sat, 18 Jul 2026 14:02:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784383363; cv=none; b=pB5uMxD+8xSdauBBzZ8bnOlSfqe62xsQz6VHowH/fGU3AT87aY4a7PKrdhvROpACvFVtPHJBS73abYrvmXYcDxOAdMpduf9zNbp07X2ljb+QLfZ6/k+/Jjmn1ivVTb4q/hBu+yx6tfs+8xThooZjNWtPlQBRmgyB3xxyfKPIgLU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784383363; c=relaxed/simple; bh=OzmVChtOtQm/sye1P1Novb0Fe3/h71JuRhf3xdl4P1s=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=HW518UU604PyJgD2TWQQbrPlKJ0N4ADmhlvFgLk3VSBgqJTmV8ZNPBpSoDfPPQKLefmPLpcepjSfieNTtNbGDoRc2mWjAnOP17fazWGGCRh2JZMXwYc+61GthsDCmCs7jSby3sdDRUuYCN7k96syPQDSUowDuvFawsEE24W9wvk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=YwZE9lJi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="YwZE9lJi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC0221F000E9; Sat, 18 Jul 2026 14:02:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784383361; bh=6uRpF2U/w3o2ycznHchTy5ViIUzjrBqaM12oE1XoAgY=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=YwZE9lJiP8LRbd05kqhLtQmGrQN/7UEu1VfL87QvOLvVdQ+0dahjmpi2RVblYCApg w9QtGtQ04JJ0oO0da7onElS0TwtfuOw3Ik9bympxd+aNt3h2wcw4r7SKkrE+CE/MoP AADDKW42ZW9+y8HPrdf6A7dg6FcH3DxWGqhTd94e/Xl8fM7BfQhJdjBCXMatsbWdCk 7rEHuNDK/EBHchlcDGQ2E22j8C1j3l9K0tmiUSMG8EbFq2V+FIXMS2VFRBFQWsKcQ4 ig301tDM6DWFrZooSP//x8AnfDsmjJyD34HlTxG0wHAXeleC7osGKXIu/dm4mYgCDM imQB8y/NZNXIw== Date: Sat, 18 Jul 2026 15:02:26 +0100 From: "Lorenzo Stoakes (ARM)" To: Yi Xie Cc: akpm@linux-foundation.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] ipc/shm: check shm_lock() in do_shmat cleanup Message-ID: References: <20260716075330.96378-1-xieyi@kylinos.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260716075330.96378-1-xieyi@kylinos.cn> On Thu, Jul 16, 2026 at 03:53:30PM +0800, Yi Xie wrote: > do_shmat() calls shm_lock() in the out_nattch branch and > immediately dereferences it, however shm_lock() can return an > error. > > Check for an error and handle it if there is one. > > Signed-off-by: Yi Xie LGTM, so: Reviewed-by: Lorenzo Stoakes (ARM) > --- Small note - it's useful to put a list of changes per version and links to the previous versions on lore after the '---' for reviewers. Anything after the --- and before the patch won't go upstream. > ipc/shm.c | 14 +++++++++----- > 1 file changed, 9 insertions(+), 5 deletions(-) > > diff --git a/ipc/shm.c b/ipc/shm.c > index b3e8a58e177d..d243137c4dbd 100644 > --- a/ipc/shm.c > +++ b/ipc/shm.c > @@ -1677,12 +1677,16 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, > out_nattch: > down_write(&shm_ids(ns).rwsem); > shp = shm_lock(ns, shmid); > - shp->shm_nattch--; > + if (IS_ERR(shp)) { > + err = PTR_ERR(shp); > + } else { > + shp->shm_nattch--; > > - if (shm_may_destroy(shp)) > - shm_destroy(ns, shp); > - else > - shm_unlock(shp); > + if (shm_may_destroy(shp)) > + shm_destroy(ns, shp); > + else > + shm_unlock(shp); > + } > up_write(&shm_ids(ns).rwsem); > return err; > > -- > 2.25.1 > Cheers, Lorenzo