diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2011-07-29 03:55:31 +0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2011-07-30 08:44:19 -1000 |
| commit | 5774ed014f02120db9a6945a1ecebeb97c2acccb (patch) | |
| tree | 74174553e2729fd582dc73f9d61b2a54286b3ede /include/linux/shm.h | |
| parent | 6c6e3b828b2a13b923b9465fc4316c5bdc92291f (diff) | |
| download | linux-5774ed014f02120db9a6945a1ecebeb97c2acccb.tar.gz linux-5774ed014f02120db9a6945a1ecebeb97c2acccb.tar.bz2 linux-5774ed014f02120db9a6945a1ecebeb97c2acccb.zip | |
shm: handle separate PID namespaces case
shm_try_destroy_orphaned() and shm_try_destroy_current() didn't handle
the case of separate PID namespaces, but a single IPC namespace. If
there are tasks with the same PID values using the same shmem object,
the wrong destroy decision could be reached.
On shm segment creation store the pointer to the creator task in
shmid_kernel->shm_creator field and zero it on task exit. Then
use the ->shm_creator insread of shm_cprid in both functions. As
shmid_kernel object is already locked at this stage, no additional
locking is needed.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux/shm.h')
| -rw-r--r-- | include/linux/shm.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/linux/shm.h b/include/linux/shm.h index 7d27ffde0190..92808b86703b 100644 --- a/include/linux/shm.h +++ b/include/linux/shm.h @@ -95,6 +95,9 @@ struct shmid_kernel /* private to the kernel */ pid_t shm_cprid; pid_t shm_lprid; struct user_struct *mlock_user; + + /* The task created the shm object. NULL if the task is dead. */ + struct task_struct *shm_creator; }; /* shm_mode upper byte flags */ |