• Eric W. Biederman's avatar
    ipc/shm: Fix pid freeing. · 2236d4d3
    Eric W. Biederman authored
    The 0day kernel test build report reported an oops:
    >
    >  IP: put_pid+0x22/0x5c
    >  PGD 19efa067 P4D 19efa067 PUD 0
    >  Oops: 0000 [#1]
    >  CPU: 0 PID: 727 Comm: trinity Not tainted 4.16.0-rc2-00010-g98f929b1 #1
    >  RIP: 0010:put_pid+0x22/0x5c
    >  RSP: 0018:ffff986719f73e48 EFLAGS: 00010202
    >  RAX: 00000006d765f710 RBX: ffff98671a4fa4d0 RCX: ffff986719f73d40
    >  RDX: 000000006f6e6125 RSI: 0000000000000000 RDI: ffffffffa01e6d21
    >  RBP: ffffffffa0955fe0 R08: 0000000000000020 R09: 0000000000000000
    >  R10: 0000000000000078 R11: ffff986719f73e76 R12: 0000000000001000
    >  R13: 00000000ffffffea R14: 0000000054000fb0 R15: 0000000000000000
    >  FS:  00000000028c2880(0000) GS:ffffffffa06ad000(0000) knlGS:0000000000000000
    >  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    >  CR2: 0000000677846439 CR3: 0000000019fc1005 CR4: 00000000000606b0
    >  Call Trace:
    >   ? ipc_update_pid+0x36/0x3e
    >   ? newseg+0x34c/0x3a6
    >   ? ipcget+0x5d/0x528
    >   ? entry_SYSCALL_64_after_hwframe+0x52/0xb7
    >   ? SyS_shmget+0x5a/0x84
    >   ? do_syscall_64+0x194/0x1b3
    >   ? entry_SYSCALL_64_after_hwframe+0x42/0xb7
    >  Code: ff 05 e7 20 9b 03 58 c9 c3 48 ff 05 85 21 9b 03 48 85 ff 74 4f 8b 47 04 8b 17 48 ff 05 7c 21 9b 03 48 83 c0 03 48 c1 e0 04 ff ca <48> 8b 44 07 08 74 1f 48 ff 05 6c 21 9b 03 ff 0f 0f 94 c2 48 ff
    >  RIP: put_pid+0x22/0x5c RSP: ffff986719f73e48
    >  CR2: 0000000677846439
    >  ---[ end trace ab8c5cb4389d37c5 ]---
    >  Kernel panic - not syncing: Fatal exception
    
    In newseg when changing shm_cprid and shm_lprid from pid_t to struct
    pid* I misread the kvmalloc as kvzalloc and thought shp was
    initialized to 0.  As that is not the case it is not safe to for the
    error handling to address shm_cprid and shm_lprid before they are
    initialized.
    
    Therefore move the cleanup of shm_cprid and shm_lprid from the no_file
    error cleanup path to the no_id error cleanup path.  Ensuring that an
    early error exit won't cause the oops above.
    Reported-by: default avatarkernel test robot <fengguang.wu@intel.com>
    Reviewed-by: default avatarNagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
    Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
    2236d4d3
shm.c 39.5 KB