Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   ebiederm@xmission.com (Eric W. Biederman)
To:     Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com>
Cc:     kernel test robot <fengguang.wu@intel.com>, LKP <lkp@01.org>,
        linux-kernel@vger.kernel.org, wfg@linux.intel.com
References: <5abb446e.XtEK088UbWSHCPaF%fengguang.wu@intel.com>
        <f249d351-240a-8c0e-ef50-f9155b696e86@oracle.com>
Date:   Wed, 28 Mar 2018 12:53:31 -0500
In-Reply-To: <f249d351-240a-8c0e-ef50-f9155b696e86@oracle.com> (Nagarathnam
        Muthusamy's message of "Wed, 28 Mar 2018 10:22:16 -0700")
Message-ID: <87o9j8axyc.fsf@xmission.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8BIT
Subject: Re: 98f929b1bd ("ipc/shm: Fix shmctl(..., IPC_STAT, ...) between .."): Oops: 0000 [#1]
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Nagarathnam Muthusamy <nagarathnam.muthusamy@oracle.com> writes:

> Hi Eric,
>
>     From
> https://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace.git/tree/ipc/shm.c?h=for-next
>
> It looks like if the following condition in Line 616 succeeds
>
> error = PTR_ERR(file);
> if (IS_ERR(file))
>     goto no_file;
>
> we get to no_file with garbage value in shm_cprid. An attempt to
> put_pid on this garbage value might be causing panic.
>
> We could initialize shm_cprid to NULL as soon as it was created.

Yes.  I misread the kvmalloc as a kvzalloc.
I am planning on placing the pid freeing under the no_id label
instead of the no_file label.  Which should also avoid the issue.

It is a rare enough issue an incremental patch should be fine.

Eric