From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8451A3D810C; Tue, 16 Jun 2026 18:26:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634409; cv=none; b=YA7ckwR0zb2Uh8tcm/s75TtDlP9W47/1jz5HwCZHYL/QGmJNIufeD6nS9Qp55mALwx3QmDKOsQ0Cp2aV4ddHI6k8A4jdtJpQXhlI8ojZzZWK1k88/fIa0cZmePU8xwsGSy4MrA8vhY7a5a/b9BQr6mtd1IuR9na+lQ30uzeiIeM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781634409; c=relaxed/simple; bh=9D5nKbM5MpZYs9kzOIv94Uaw+0O70LygcJTCH4DcRHo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=vFbgC2XFSWyL6W3eeU0qce9Cg+cNO1Kf8qXVmp6BEa1o09vLGfcnLo7g9aeK9+Rmh6LmHT0acEkeY/3YQ2mEzNlcw2HfA+WXMpLv+f7RMRvspAHJx3pBRZ9HwOu13iU98e1Hi8QMHLgLl5De2/oPu+5q2v1UvXQ/66zrQGWKICY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Pwv1etSv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Pwv1etSv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2ADAC1F000E9; Tue, 16 Jun 2026 18:26:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1781634408; bh=Wq1REARUcGdOYf45/07K2wpwBnllS0gcyhsi/4d1Hqw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Pwv1etSvbhO+vw97az5VkvdzxWzF/YtAW/NVPI6eQQDv4dlA/aufpWyjpjW+mdOQG jVuggs4p/zf6MP1jgfSZYRzXpervzXBCzcE4Hhf8QQ2BO5UJzgOaujhj4hkszTgnoW fBBYrSalvyA4HCDRV96Pb4bTeaGlKPAYQd2DTLAA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Yuan Tan , Yifan Wu , Juefei Pu , Xin Liu , Yilin Zhu , Ren Wei , Christian Brauner , Jeongjun Park , Kees Cook , Liam Howlett , Lorenzo Stoakes , Serge Hallyn , Vasiliy Kulikov , Davidlohr Bueso , Oleg Nesterov , Serge Hallyn , Andrew Morton Subject: [PATCH 5.15 226/411] ipc/shm: serialize orphan cleanup with shm_nattch updates Date: Tue, 16 Jun 2026 20:27:44 +0530 Message-ID: <20260616145112.819120223@linuxfoundation.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260616145100.376842714@linuxfoundation.org> References: <20260616145100.376842714@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yilin Zhu commit 2e5c6f4fd4001562781e99bbfc7f1f0127187542 upstream. shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem. Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal. Link: https://lore.kernel.org/9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234.git.zylzyl2333@gmail.com Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Reported-by: Yuan Tan Reported-by: Yifan Wu Reported-by: Juefei Pu Reported-by: Xin Liu Signed-off-by: Yilin Zhu Signed-off-by: Ren Wei Cc: Christian Brauner Cc: Jeongjun Park Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Serge Hallyn Cc: Vasiliy Kulikov Cc: Davidlohr Bueso Cc: Oleg Nesterov Cc: Serge Hallyn Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- ipc/shm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/ipc/shm.c +++ b/ipc/shm.c @@ -402,15 +402,17 @@ static int shm_try_destroy_orphaned(int * We want to destroy segments without users and with already * exit'ed originating process. * - * As shp->* are changed under rwsem, it's safe to skip shp locking. + * shm_nattch can be changed under shm_perm.lock without holding the + * rwsem, so take the object lock before checking shm_may_destroy(). */ if (!list_empty(&shp->shm_clist)) return 0; - if (shm_may_destroy(shp)) { - shm_lock_by_ptr(shp); + shm_lock_by_ptr(shp); + if (shm_may_destroy(shp)) shm_destroy(ns, shp); - } + else + shm_unlock(shp); return 0; }