From nobody Thu Apr 2 12:36:48 2026 Received: from mail-dl1-f49.google.com (mail-dl1-f49.google.com [74.125.82.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBEC118C2C for ; Sun, 29 Mar 2026 01:36:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.49 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774748214; cv=none; b=XTe00wwyTL2PeMxGjUUyF8yFC0AVwfdu6dlBylqNG8GGqcomHMG7XqUoh8g6iPh/mOea4z6AUWAAr4k8ot9sQcV9LDxDuL4RINLycVUadYDUSj6Q62l/Klbqt/xTIhpnFBOFZeq8rDyXW7l4JUUFj0feVmjzI5LxC0oN3SRsXEo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774748214; c=relaxed/simple; bh=Nq+GQDQJTmZ91UTYt6tgnJ8EpIR9hI8mNf09LGnkkUA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ry8tBjtwE0Qvd7OTl0RJPAzrc+/LHNkEpe1dN71hruXG/SYZFf+HDJeXhtxB6R+12iGGRGqKqCbh4Zgc/8IBbbo39IuGE0d6lYM6UTvh3/4z9hyC4ERz8mo7AA4iwkx4uPIvfCYWWt0vTikwdg+dMtoPH6m6gxiD1nN0xqe2L00= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=EW+CgUUB; arc=none smtp.client-ip=74.125.82.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="EW+CgUUB" Received: by mail-dl1-f49.google.com with SMTP id a92af1059eb24-126ea4e9694so4203893c88.1 for ; Sat, 28 Mar 2026 18:36:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1774748212; x=1775353012; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=DBpKSca5Ay16iTg5uRkd4hHbSfTBkYMThm1yhtVS3Ck=; b=EW+CgUUBE2Y18Y0ukwRQIuUY5byRg9DbgardQJYSL8p4N1bjp/C7yb2PH8O9asRGSe 7YOD9oINxpdKJn6HPJCjyoi7Tpph8fXGuInqgdXOpuUAEUkNHLjZ9Kiz69rUxOLFmD5H MssNG1W1bfgNIwywiK5xrUSJ3igGR3Ioijy+/5KHCy86zr6GnVN20XFMJi+fzDGeIl+3 L5cdS6RZlTqdFLidGvfM3lVwYT2H6/Aiz5sq+92lAqy0YsUVPc+YrSYC4jWRybiIyEyy 0r/dhK0c06/HqHKy5eqByzI005zdbwuhLl11PzSkN1qh3HNfBGIj17mpkQkDwGWFFoME pygQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774748212; x=1775353012; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=DBpKSca5Ay16iTg5uRkd4hHbSfTBkYMThm1yhtVS3Ck=; b=CWVmDR7VZyMbQM1jlDU1uV2fiAeDvGfsh3YtrLmjxZ/5Q5tOlOwdSVIfbKTjoMhTS4 Bk8i5mems48QLhyuBF0PNvZJ4nQfHmHlTxNS2J7y1ZSWhNKL5g7mgdpxY+q3cfPUPshT 6pHt3ekIBRJzWnjCcFFvGJaRqlfJpn/7NXJmoH8dyY36zEq+fp5A45VhNW4K1KCJMXCf qbm+75+0DLGv3JM9IvJhcOMzlVKNaG9Vtngefka9Y0wjcMgQnzM/KOED7a9LEHqXHl3Q KP1YXAJgTXHA7Pccx/daSeAYFljXSTT3WxvDmhgbox+eiwn2TP8gkS+iYiuUUVHIW0am dilA== X-Gm-Message-State: AOJu0Yxs0tJgd6LevBsQ2rK6A6pZE3j8AUefdfbKWzUO0DVc2D12wuFL 5Ahg8GceUMn89xv79Ufs4HZLy55J193zIhsMnxNzR5/56WtywbqEexFMlfS6KPy8NXCpYBH2ESp ANvaaOA== X-Gm-Gg: ATEYQzwrbHYYcbRbV8Q6S+LQGCPDANtivuYqPwEDKD0HvZjwTQlw03yWRi6xVqMD7u+ YIFaUC8x90BAJZ59bTAO6P448FiAhma+oSWuDEu7i4RIqscCpe12tjDyRF7M+CnZGWUGGR5EwdR 3kECJWpnH/4zD0khqreqO605PlCLzMhAWGC7jsRk8VV4xrAcIVBeOEEjoImZakooyIhdF8s3hF+ wWYIqlJBSwgvGC+/zrYtbvLNmI50H2d9HQWS+hDpqAYrTxPBCQHPAAxzrA6gZui5bXhlno3uKAK eTp9U/m8v+XCGOJizWr2XGIUW7KZqPRMHbl6ghlzj2y4lY6qqSknxg5lprL2Ra8vyCDyHWCUnna QEb0zmLEXi2BlVkfd+GdVBHPLNH0HcnTAkHU0gT0wlQGls2Pd8xHv/lEiWbG0+sTRZ3ehJ3izwg V36ijH1bKfFRgtQmZODpS4/SDypJZtEmaboL9qgWlY97eDUa9M6PxanQ== X-Received: by 2002:a05:7022:797:b0:128:d4be:7428 with SMTP id a92af1059eb24-12ab28e4d97mr4721797c88.19.1774748211620; Sat, 28 Mar 2026 18:36:51 -0700 (PDT) Received: from p1.scai.dhcp.asu.edu (209-147-138-15.nat.asu.edu. [209.147.138.15]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-12abde65313sm2408488c88.14.2026.03.28.18.36.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 28 Mar 2026 18:36:50 -0700 (PDT) From: Xiang Mei To: linux-kernel@vger.kernel.org Cc: akpm@linux-foundation.org, ljs@kernel.org, Liam.Howlett@oracle.com, brauner@kernel.org, baolin.wang@linux.alibaba.com, aha310510@gmail.com, kees@kernel.org, bestswngs@gmail.com, Xiang Mei Subject: [PATCH ipc] ipc/shm: fix race between shm_try_destroy_orphaned and do_shmat Date: Sat, 28 Mar 2026 18:36:46 -0700 Message-ID: <20260329013646.1188553-1-xmei5@asu.edu> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" shm_try_destroy_orphaned() reads shm_nattch via shm_may_destroy() without holding the per-object spinlock, relying on rwsem alone for synchronization. However, do_shmat() modifies shm_nattch under the per-object spinlock (not rwsem), creating a TOCTOU race: CPU 0 (do_shmat) CPU 1 (shm_try_destroy_orphaned) ipc_lock_object() shm_nattch++ (0 -> 1) ipc_unlock_object() shm_may_destroy() -> reads stale nattch=3D= =3D0 shm_lock_by_ptr() shm_destroy() // nattch is actually 1! The segment is destroyed while do_shmat() has already incremented shm_nattch and is proceeding with the mmap setup. When do_shmat() later reaches out_nattch, shm_lock() returns ERR_PTR (the IDR entry was removed by shm_destroy) and the code dereferences it without an IS_ERR() check, causing a null-ptr-deref crash: BUG: kernel NULL pointer dereference, address: 0000000000000072 RIP: 0010:do_shmat (ipc/shm.c:1678) Call Trace: __x64_sys_shmat (ipc/shm.c:1699 ipc/shm.c:1693 ipc/shm.c:1693) do_syscall_64 (arch/x86/entry/syscall_64.c:94) [...] Fix by taking the object lock before checking shm_may_destroy() in shm_try_destroy_orphaned(), so the check sees the up-to-date value of shm_nattch. Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Reported-by: Weiming Shi Signed-off-by: Xiang Mei --- ipc/shm.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index a95dae447707..50f9aa7ff33a 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -416,17 +416,18 @@ static int shm_try_destroy_orphaned(int id, void *p, = void *data) =20 /* * We want to destroy segments without users and with already - * exit'ed originating process. - * - * As shp->* are changed under rwsem, it's safe to skip shp locking. + * exit'ed originating process. Take the object lock before + * checking shm_may_destroy() since shm_nattch can be modified + * under the object lock alone (e.g. by do_shmat). */ if (!list_empty(&shp->shm_clist)) return 0; =20 - if (shm_may_destroy(shp)) { - shm_lock_by_ptr(shp); + shm_lock_by_ptr(shp); + if (shm_may_destroy(shp)) shm_destroy(ns, shp); - } + else + shm_unlock(shp); return 0; } =20 --=20 2.43.0