-
Vasiliy Kulikov authored
shm_lock() does a lookup of shm segment in shm_ids(ns).ipcs_idr, which is redundant as we already know shmid_kernel address. An actual lock is also not required for reads until we really want to destroy the segment. exit_shm() and shm_destroy_orphaned() may avoid the loop by checking whether there is at least one segment in current ipc_namespace. The check of nsproxy and ipc_ns against NULL is redundant as exit_shm() is called from do_exit() before the call to exit_notify(), so the dereferencing current->nsproxy->ipc_ns is guaranteed to be safe. Reported-by:
Oleg Nesterov <oleg@redhat.com> Signed-off-by:
Vasiliy Kulikov <segoon@openwall.com> Acked-by:
Serge Hallyn <serge.hallyn@canonical.com> Signed-off-by:
Linus Torvalds <torvalds@linux-foundation.org>
4c677e2e