From: ebiederm@xmission.com (Eric W. Biederman)
To: Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
Cc: kernel test robot <fengguang.wu@intel.com>, LKP <lkp@01.org>,
linux-kernel@vger.kernel.org, wfg@linux.intel.com
Subject: Re: 98f929b1bd ("ipc/shm: Fix shmctl(..., IPC_STAT, ...) between .."): Oops: 0000 [#1]
Date: Wed, 28 Mar 2018 12:53:31 -0500 [thread overview]
Message-ID: <87o9j8axyc.fsf@xmission.com> (raw)
In-Reply-To: <f249d351-240a-8c0e-ef50-f9155b696e86@oracle.com> (Nagarathnam Muthusamy's message of "Wed, 28 Mar 2018 10:22:16 -0700")
Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com> writes:
> Hi Eric,
>
> From
> https://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git/tree/ipc/shm.c?h=for-next
>
> It looks like if the following condition in Line 616 succeeds
>
> error = PTR_ERR(file);
> if (IS_ERR(file))
> goto no_file;
>
> we get to no_file with garbage value in shm_cprid. An attempt to
> put_pid on this garbage value might be causing panic.
>
> We could initialize shm_cprid to NULL as soon as it was created.
Yes. I misread the kvmalloc as a kvzalloc.
I am planning on placing the pid freeing under the no_id label
instead of the no_file label. Which should also avoid the issue.
It is a rare enough issue an incremental patch should be fine.
Eric
next prev parent reply other threads:[~2018-03-28 17:54 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-28 7:29 98f929b1bd ("ipc/shm: Fix shmctl(..., IPC_STAT, ...) between .."): Oops: 0000 [#1] kernel test robot
2018-03-28 17:22 ` Nagarathnam Muthusamy
2018-03-28 17:53 ` Eric W. Biederman [this message]
2018-03-28 18:47 ` [PATCH] ipc/shm: Fix pid freeing Eric W. Biederman
2018-03-28 19:57 ` Nagarathnam Muthusamy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87o9j8axyc.fsf@xmission.com \
--to=ebiederm@xmission.com \
--cc=fengguang.wu@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@01.org \
--cc=nagarathnam.muthusamy@oracle.com \
--cc=wfg@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox