Re: [kernel-hardening] Re: [PATCH] shm: handle separate PID namespaces case

Oleg Nesterov
2011-07-06T18:08:32Z

On 07/06, Vasiliy Kulikov wrote:
>
> > > +void exit_shm(struct task_struct *task)
> > > +{
> > > + struct ipc_namespace *ns = task->nsproxy->ipc_ns;
> > > +
> > > + /* Destroy all already created segments, but not mapped yet */
> > > + down_write(&shm_ids(ns).rw_mutex);
> > > + if (&shm_ids(ns).in_use)
> > > + idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_current, ns);
> > > + up_write(&shm_ids(ns).rw_mutex);
> >
> > Having exit_shm() call shm_destroy_orphaned(task->nsproxy->ipc_ns) seems
> > more future-proof?
>
> shm_destroy_orphaned() doesn't clear ->shm_creator. Logically it sovles
> another problem - it is used ONLY to be consistent while changing
> kernel.shm_rmid_forced (having orphans with shm_rmid_forced=1 is not
> honest).

Yes, there are different things.

Cough. I stil think exit_shm() should check .in_use != 0 lockless.

Oleg.