From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA50E333439 for ; Thu, 30 Apr 2026 15:37:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777563467; cv=none; b=nB5B5s9KAXqNFakK/dBta8KpUOPO2DYPF5PidhKwNafg2v4tv8zWVyIIS4nDybUa1GPkVv+xs/VQlv7v7F//ryfarDPor98oOkRipBM5a1LG1pka1PIYiXiQzR+oFj3AwnaC4TtuLWE9aOAFJjqkogDLTgdVPh3Pfd6OOVlbR5k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777563467; c=relaxed/simple; bh=QM2mf14vViAFsBHEEFgUb59w1bgcMGoWzimnJeSwu2Q=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=kXMh4Nz9rVJT6EZ4uK6Z54v5yOqUABb9nhs6GKVkU1oPeoSlYHaR8ZQUMqyPXZPG8XDPsXo1yGyOQtjiaZ+pYtf1Jry/ueysNF81W30/DwHFsTir4OPKvA0Vo1BN05IlWVZ1RCwhAdZXrCNHwjGBMrLwhaQBFCJnYCQQJb+7sgk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=a1EEEBGF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="a1EEEBGF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91991C2BCB8; Thu, 30 Apr 2026 15:37:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1777563465; bh=QM2mf14vViAFsBHEEFgUb59w1bgcMGoWzimnJeSwu2Q=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=a1EEEBGFt+wltBHMaYZgk11sDp0nUMNY8JVK8hJGQLpi8O8ms9NuLuF8/NqMq5kIw hn2ItBi+VT17PAh0ixRacIHnuucbUm1giNWRX6jEu8PuLAr5TLJIwKx4RAnQe31KtS KdUM0rWQQ/4udvj/OleJ/pnUh3MDQcgZSOe4HRM4= Date: Thu, 30 Apr 2026 08:37:43 -0700 From: Andrew Morton To: Ren Wei Cc: linux-kernel@vger.kernel.org, ljs@kernel.org, Liam.Howlett@oracle.com, brauner@kernel.org, kees@kernel.org, aha310510@gmail.com, sergeh@kernel.org, segoon@openwall.com, yuantan098@gmail.com, yifanwucs@gmail.com, tomapufckgml@gmail.com, bird@lzu.edu.cn, zylzyl2333@gmail.com, Oleg Nesterov , Serge Hallyn , Vasiliy Kulikov , Davidlohr Bueso Subject: Re: [PATCH 1/1] ipc/shm: serialize orphan cleanup with shm_nattch updates Message-Id: <20260430083743.b8c2ae998664c346ab3c8091@linux-foundation.org> In-Reply-To: <9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234.git.zylzyl2333@gmail.com> References: <9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234.git.zylzyl2333@gmail.com> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 30 Apr 2026 13:21:34 +0800 Ren Wei wrote: > From: Yilin Zhu > > shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but > that does not serialize all fields tested by shm_may_destroy(). In > particular, shm_nattch is updated while holding shm_perm.lock, and attach > paths can do that without holding the rwsem. > > Do not decide that an orphaned segment is unused before taking the object > lock. Move the shm_may_destroy() check under shm_perm.lock, matching the > other destroy paths, and unlock the segment when it no longer qualifies > for removal. Thanks. > Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Let's cc more people who were involved in 4c677e2eefdb. And Davidlohr, who might have opinions. > Cc: stable@kernel.org > Reported-by: Yuan Tan > Reported-by: Yifan Wu > Reported-by: Juefei Pu > Reported-by: Xin Liu > Signed-off-by: Yilin Zhu > Signed-off-by: Ren Wei > --- > ipc/shm.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/ipc/shm.c b/ipc/shm.c > index a95dae447707..b3e8a58e177d 100644 > --- a/ipc/shm.c > +++ b/ipc/shm.c > @@ -418,15 +418,17 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) > * We want to destroy segments without users and with already > * exit'ed originating process. > * > - * As shp->* are changed under rwsem, it's safe to skip shp locking. > + * shm_nattch can be changed under shm_perm.lock without holding the > + * rwsem, so take the object lock before checking shm_may_destroy(). > */ > if (!list_empty(&shp->shm_clist)) > return 0; > > - if (shm_may_destroy(shp)) { > - shm_lock_by_ptr(shp); > + shm_lock_by_ptr(shp); > + if (shm_may_destroy(shp)) > shm_destroy(ns, shp); > - } > + else > + shm_unlock(shp); > return 0; > }