Hi Davidlohr,
On 05/30/2015 02:03 AM, Davidlohr Bueso wrote:
Upon every shm_lock call, we BUG_ON if an error was returned,
indicating racing either in idr or in RMID. Move this logic
into the locking.
Signed-off-by: Davidlohr Bueso <dbu...@suse.de>
---
ipc/shm.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/ipc/shm.c b/ipc/shm.c
index 6d76707..3152dea 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -155,8 +155,14 @@ static inline struct shmid_kernel *shm_lock(struct
ipc_namespace *ns, int id)
{
struct kern_ipc_perm *ipcp = ipc_lock(&shm_ids(ns), id);
- if (IS_ERR(ipcp))
+ if (IS_ERR(ipcp)) {
+ /*
+ * We raced in the idr lookup or with RMID,
+ * either way, the ID is busted.
The comment is wrong:
"We raced in the idr lookup or with shm_destroy()"
shm is not like msg or sem:
RMID merely marks a shmid as deletable (SHM_DEST), delete (i.e.:
shm_rmid(), then ipc_rmid()) happens only after the last attached
segment is detatched.
And: (unrelated to the patch)
For do_shmat(), I'm not 100% sure that the BUG can't be triggered.
--
Manfred
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
