In 2.2.19pre3, IPC_RMID had the following change:
case IPC_RMID:
if (current->euid == shp->u.shm_perm.uid ||
current->euid == shp->u.shm_perm.cuid ||
capable(CAP_SYS_ADMIN)) {
shp->u.shm_perm.mode |= SHM_DEST;
if (shp->u.shm_nattch <= 0)
killseg (id);
+ /* Do not find it any more */
+ shp->u.shm_perm.key = IPC_PRIVATE;
break;
}
err = -EPERM;
goto out;
I've two questions related to the change:
1) Should not the two new lines have been inserted before the
killseg() call? It appears that killseg() will kfree() the
storage backing shp!?! If so, the key setting portion could
be altering anything or faulting, no?
2) on 2.2.19pre{7-9} I've seen occasion glitches wherein it appears
that shm_ctl(IPC_RMID) hasn't set the key to IPC_PRIVATE, because
an attempt to recreate the segment fails (but only sometimes).
Has anyone else seen this? Is it possibly related to the above
issue?
--
Rick Nelson
Life'll kill ya -- Warren Zevon
Then you'll be dead -- Life'll kill ya