linux-kernel - futex and shared memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 15 Jun 2009 13:29:02 -0400 (EDT)
From:	Andrew Michael Wesie <awesie@...rew.cmu.edu>
To:	linux-kernel@...r.kernel.org
Subject: futex and shared memory

I have a set of LWPs with non-shared page tables (no CLONE_VM flag) and am 
also using the CLONE_CHILD_CLEARTID flag. The ctid variable points to a 
memory that has been mmap'd MAP_SHARED, so that it will be shared with 
both the parent and the child. When the child exits, the expected behavior 
is for the memory pointed to by ctid to be cleared. From what I could 
tell, this wasn't happening.

After looking at mm_release in fork.c, which is responsible for clearing 
the tid variable, it looks like this doesn't work since mm_release checks 
if there is more than one "user" of the memory space. I am including a 
patch to take out the check, but am not confident that this is the 
problem. It would help if I had a clearer understanding of what mm_user 
actually represented.

A patch for 2.6.30 follows.

--
Andrew Wesie
awesie@...rew.cmu.edu

--- linux-2.6.30/kernel/fork.c.orig     2009-06-15 13:25:52.000000000 
-0400
+++ linux-2.6.30/kernel/fork.c  2009-06-15 13:26:25.000000000 -0400
@@ -569,8 +569,7 @@ void mm_release(struct task_struct *tsk,
          * trouble otherwise.  Userland only wants this done for a 
sys_exit.
          */
         if (tsk->clear_child_tid
-           && !(tsk->flags & PF_SIGNALED)
-           && atomic_read(&mm->mm_users) > 1) {
+           && !(tsk->flags & PF_SIGNALED)) {
                 u32 __user * tidptr = tsk->clear_child_tid;
                 tsk->clear_child_tid = NULL;

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/