[kernel-hardening] Re: [PATCH] shm: optimize locking and ipc_namespace getting

Oleg Nesterov
2011-07-04T17:29:45Z

On 07/04, Vasiliy Kulikov wrote:
>
> exit_shm() and shm_destroy_orphaned() may avoid the loop by checking
> whether there is at least one segment in current ipc_namespace.

Obviously I can't ack because I do not really understand this code,
but looks good to me.

Minor nit,

> void exit_shm(struct task_struct *task)
> {
> - struct nsproxy *nsp = task->nsproxy;
> - struct ipc_namespace *ns;
> -
> - if (!nsp)
> - return;
> - ns = nsp->ipc_ns;
> - if (!ns)
> - return;
> + struct ipc_namespace *ns = task->nsproxy->ipc_ns;
>
> /* Destroy all already created segments, but not mapped yet */
> down_write(&shm_ids(ns).rw_mutex);
> - idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_current, ns);
> + if (&shm_ids(ns).in_use)

Afaics, unlike shm_destroy_orphaned(), exit_shm() can check .in_use
lockless and thus avoid down_write() in the fast path. Given that
this sem is "global", I think this makes sense.

exit_shm() only cares about shmid_kernel's which were created by
current, we can't miss .in_use++ in ipc_addid(), it was called by us.
and thus we can't miss in_use != 0 although it is not stable without
the lock.

Oleg.