https://github.com/torvalds/linux
Revision 1ac0b6dec656f3f78d1c3dd216fad84cb4d0a01e authored by Kirill A. Shutemov on 17 February 2016, 21:11:35 UTC, committed by Linus Torvalds on 19 February 2016, 00:23:24 UTC
remap_file_pages(2) emulation can reach file which represents removed
IPC ID as long as a memory segment is mapped. It breaks expectations of
IPC subsystem.
Test case (rewritten to be more human readable, originally autogenerated
by syzkaller[1]):
#define _GNU_SOURCE
#include <stdlib.h>
#include <sys/ipc.h>
#include <sys/mman.h>
#include <sys/shm.h>
#define PAGE_SIZE 4096
int main()
{
int id;
void *p;
id = shmget(IPC_PRIVATE, 3 * PAGE_SIZE, 0);
p = shmat(id, NULL, 0);
shmctl(id, IPC_RMID, NULL);
remap_file_pages(p, 3 * PAGE_SIZE, 0, 7, 0);
return 0;
}
The patch changes shm_mmap() and code around shm_lock() to propagate
locking error back to caller of shm_mmap().
[1] http://github.com/google/syzkaller
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 64f0085
Tip revision: 1ac0b6dec656f3f78d1c3dd216fad84cb4d0a01e authored by Kirill A. Shutemov on 17 February 2016, 21:11:35 UTC
ipc/shm: handle removed segments gracefully in shm_mmap()
ipc/shm: handle removed segments gracefully in shm_mmap()
Tip revision: 1ac0b6d
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitignore | -rw-r--r-- | 1.2 KB |
| .mailmap | -rw-r--r-- | 5.5 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 95.4 KB |
| Kbuild | -rw-r--r-- | 2.6 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 337.0 KB |
| Makefile | -rw-r--r-- | 53.7 KB |
| README | -rw-r--r-- | 18.2 KB |
| REPORTING-BUGS | -rw-r--r-- | 7.3 KB |
Computing file changes ...
