kernel/linux.git/ipc/shm.c, branch linux-2.6.22.y

Fix user struct leakage with locked IPC shem segment

2007-08-09T21:27:36+00:00

When user locks an ipc shmem segmant with SHM_LOCK ctl and the segment is already locked the shmem_lock() function returns 0. After this the subsequent code leaks the existing user struct: == ipc/shm.c: sys_shmctl() == ... err = shmem_lock(shp->shm_file, 1, user); if (!err) { shp->shm_perm.mode |= SHM_LOCKED; shp->mlock_user = user; } ... == Other results of this are: 1. the new shp->mlock_user is not get-ed and will point to freed memory when the task dies. 2. the RLIMIT_MEMLOCK is screwed on both user structs. The exploit looks like this: == id = shmget(...); setresuid(uid, 0, 0); shmctl(id, SHM_LOCK, NULL); setresuid(uid + 1, 0, 0); shmctl(id, SHM_LOCK, NULL); == My solution is to return 0 to the userspace and do not change the segment's user. Signed-off-by: Pavel Emelianov Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman

shm: fix the filename of hugetlb sysv shared memory

2007-06-16T20:16:16+00:00

Some user space tools need to identify SYSV shared memory when examining /proc//maps. To do so they look for a block device with major zero, a dentry named SYSV, and having the minor of the internal sysv shared memory kernel mount. To help these tools and to make it easier for people just browsing /proc//maps this patch modifies hugetlb sysv shared memory to use the SYSV dentry naming convention. User space tools will still have to be aware that hugetlb sysv shared memory lives on a different internal kernel mount and so has a different block device minor number from the rest of sysv shared memory. Signed-off-by: Eric W. Biederman Cc: "Serge E. Hallyn" Cc: Albert Cahalan Cc: Badari Pulavarty Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

hugetlb: fix get_policy for stacked shared memory files

2007-06-16T20:16:16+00:00

Here's another breakage as a result of shared memory stacked files :( The NUMA policy for a VMA is determined by checking the following (in the order given): 1) vma->vm_ops->get_policy() (if defined) 2) vma->vm_policy (if defined) 3) task->mempolicy (if defined) 4) Fall back to default_policy By switching to stacked files for shared memory, get_policy() is now always set to shm_get_policy which is a wrapper function. This causes us to stop at step 1, which yields NULL for hugetlb instead of task->mempolicy which was the previous (and correct) result. This patch modifies the shm_get_policy() wrapper to maintain steps 1-3 for the wrapped vm_ops. (akpm: the refcounting of mempolicies is busted and this patch does nothing to improve it) Signed-off-by: Adam Litke Acked-by: William Irwin Cc: dean gaudet Cc: Christoph Lameter Cc: Andi Kleen Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

Restore shmid as inode# to fix /proc/pid/maps ABI breakage

2007-06-16T20:16:15+00:00

shmid used to be stored as inode# for shared memory segments. Some of the proc-ps tools use this from /proc/pid/maps. Recent cleanups to newseg() changed it. This patch sets inode number back to shared memory id to fix breakage. Signed-off-by: Badari Pulavarty Cc: "Albert Cahalan" Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] Fix get_unmapped_area and fsync for hugetlb shm segments

2007-03-02T01:18:39+00:00

This patch provides the following hugetlb-related fixes to the recent stacked shm files changes: - Update is_file_hugepages() so it will reconize hugetlb shm segments. - get_unmapped_area must be called with the nested file struct to handle the sfd->file->f_ops->get_unmapped_area == NULL case. - The fsync f_op must be wrapped since it is specified in the hugetlbfs f_ops. This is based on proposed fixes from Eric Biederman that were debugged and tested by me. Without it, attempting to use hugetlb shared memory segments on powerpc (and likely ia64) will kill your box. Signed-off-by: Adam Litke Cc: Eric Biederman Cc: Andrew Morton Acked-by: William Irwin Signed-off-by: Linus Torvalds

[PATCH] make ipc/shm.c:shm_nopage() static

2007-03-01T22:53:35+00:00

shm_nopage() can become static. Signed-off-by: Adrian Bunk Acked-by: Eric W. Biederman Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] shm: make sysv ipc shared memory use stacked files

2007-02-21T01:10:13+00:00

The current ipc shared memory code runs into several problems because it does not quite use files like the rest of the kernel. With the option of backing ipc shared memory with either hugetlbfs or ordinary shared memory the problems got worse. With the added support for ipc namespaces things behaved so unexpected that we now have several bad namespace reference counting bugs when using what appears at first glance to be a reasonable idiom. So to attack these problems and hopefully make the code more maintainable this patch simply uses the files provided by other parts of the kernel and builds it's own files out of them. The shm files are allocated in do_shmat and freed when their reference count drops to zero with their last unmap. The file and vm operations that we don't want to implement or we don't implement completely we just delegate to the operations of our backing file. This means that we now get an accurate shm_nattch count for we have a hugetlbfs inode for backing store, and the shm accounting of last attach and last detach time work as well. This means that getting a reference to the ipc namespace when we create the file and dropping the referenece in the release method is now safe and correct. This means we no longer need a special case for clearing VM_MAYWRITE as our file descriptor now only has write permissions when we have requested write access when calling shmat. Although VM_SHARED is now cleared as well which I believe is harmless and is mostly likely a minor bug fix. By using the same set of operations for both the hugetlb case and regular shared memory case shmdt is not simplified and made slightly more correct as now the test "vma->vm_ops == &shm_vm_ops" is 100% accurate in spotting all shared memory regions generated from sysvipc shared memory. Signed-off-by: Eric W. Biederman Cc: Michal Piotrowski Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] mark struct file_operations const 7

2007-02-12T17:48:46+00:00

Many struct file_operations in the kernel can be "const". Marking them const moves these to the .rodata section, which avoids false sharing with potential dirty data. In addition it'll catch accidental writes at compile time to these shared resources. Signed-off-by: Arjan van de Ven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

[PATCH] correct sys_shmget allocation check

2007-01-23T19:18:50+00:00

As written, sys_shmget will return ENOSPC when one page is still available for allocation. This patch corrects the test. Signed-off-by: Guy Streeter Signed-off-by: Linus Torvalds --

[PATCH] struct path: convert ipc

2006-12-08T16:28:46+00:00

Signed-off-by: Josef Sipek Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds