[kernel-hardening] Re: [PATCH] shm: optimize locking and ipc_namespace getting

[Oleg Nesterov <oleg@redhat.com>]

On 07/04, Vasiliy Kulikov wrote:
>
> exit_shm() and shm_destroy_orphaned() may avoid the loop by checking
> whether there is at least one segment in current ipc_namespace.

Obviously I can't ack because I do not really understand this code,
but looks good to me.

Minor nit,

>  void exit_shm(struct task_struct *task)
>  {
> -	struct nsproxy *nsp = task->nsproxy;
> -	struct ipc_namespace *ns;
> -
> -	if (!nsp)
> -		return;
> -	ns = nsp->ipc_ns;
> -	if (!ns)
> -		return;
> +	struct ipc_namespace *ns = task->nsproxy->ipc_ns;
>
>  	/* Destroy all already created segments, but not mapped yet */
>  	down_write(&shm_ids(ns).rw_mutex);
> -	idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_current, ns);
> +	if (&shm_ids(ns).in_use)

Afaics, unlike shm_destroy_orphaned(), exit_shm() can check .in_use
lockless and thus avoid down_write() in the fast path. Given that
this sem is "global", I think this makes sense.

exit_shm() only cares about shmid_kernel's which were created by
current, we can't miss .in_use++ in ipc_addid(), it was called by us.
and thus we can't miss in_use != 0 although it is not stable without
the lock.

Oleg.