[kernel-hardening] Re: [PATCH] shm: handle separate PID namespaces case

Oleg Nesterov
2011-07-04T15:05:13Z

On 07/04, Vasiliy Kulikov wrote:
>
> @@ -239,7 +239,23 @@ static int shm_try_destroy_current(int id, void *p, void *data)
> if (IS_ERR(shp))
> return 0;
>
> - if (shp->shm_cprid != task_tgid_vnr(current)) {
> + if (shp->shm_creator != current) {
> + shm_unlock(shp);
> + return 0;

I know absolutely nothing about ipc/, so probably I am wrong. But do
we really need shm_lock() (which also another idr_find) to check
->shm_creator ? This is calles by idr_for_each() and afaics "void *p"
should match, no?

IOW, can't shm_try_destroy_current() do something like

struct shmid_kernel *shp = container_of(p, shmid_kernel, shm_perm);

if (shp->shm_creator != current)
return;

shm_lock();
...

?

Just curious.

Oleg.