Messages in this thread | | | Subject | Re: GPF in shm_lock ipc | From | Manfred Spraul <> | Date | Sat, 2 Jan 2016 12:33:10 +0100 |
| |
Hi Dmitry,
shm locking differs too much from msg/sem locking, I never looked at it in depth, so I'm not able to perform a proper review.
Except for the obvious: Races that can be triggered from user space are inacceptable. Regardless if there is a BUG_ON, a WARN_ON or nothing at all.
On 12/21/2015 04:44 PM, Dmitry Vyukov wrote: >> + >> +/* This is called by fork, once for every shm attach. */ >> +static void shm_open(struct vm_area_struct *vma) >> +{ >> + int err = __shm_open(vma); >> + /* >> + * We raced in the idr lookup or with shm_destroy(). >> + * Either way, the ID is busted. >> + */ >> + WARN_ON_ONCE(err); >> } Is it possible to trigger this race? Parallel IPC_RMID & fork()?
-- Manfred
| |