Kirill A. Shutemov 5a1417dd08 ipc/shm: handle removed segments gracefully in shm_mmap() ... commit 1ac0b6dec656f3f78d1c3dd216fad84cb4d0a01e upstream. remap_file_pages(2) emulation can reach file which represents removed IPC ID as long as a memory segment is mapped. It breaks expectations of IPC subsystem. Test case (rewritten to be more human readable, originally autogenerated by syzkaller[1]): #define _GNU_SOURCE #include <stdlib.h> #include <sys/ipc.h> #include <sys/mman.h> #include <sys/shm.h> #define PAGE_SIZE 4096 int main() { int id; void *p; id = shmget(IPC_PRIVATE, 3 * PAGE_SIZE, 0); p = shmat(id, NULL, 0); shmctl(id, IPC_RMID, NULL); remap_file_pages(p, 3 * PAGE_SIZE, 0, 7, 0); return 0; } The patch changes shm_mmap() and code around shm_lock() to propagate locking error back to caller of shm_mmap(). [1] http://github.com/google/syzkaller Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Manfred Spraul <manfred@colorfullife.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		2019-07-27 21:52:19 +02:00
..
compat.c
compat_mq.c
ipc_sysctl.c
ipcns_notifier.c
Makefile
mq_sysctl.c
mqueue.c	mqueue: fix a use-after-free in sys_mq_notify()	2018-05-26 00:39:34 +02:00
msg.c	Initialize msg/shm IPC objects before doing ipc_addid()	2016-05-18 14:32:58 +05:30
msgutil.c	ipc: convert invalid scenarios to use WARN_ON	2019-07-27 21:52:19 +02:00
namespace.c
sem.c	Revert "ipc/sem.c: optimize sem_lock()"	2019-07-27 21:42:46 +02:00
shm.c	ipc/shm: handle removed segments gracefully in shm_mmap()	2019-07-27 21:52:19 +02:00
syscall.c
util.c	Initialize msg/shm IPC objects before doing ipc_addid()	2016-05-18 14:32:58 +05:30
util.h