Important - MM panic in 2.1.109 (and more)

Itai Nahshon (nahshon@actcom.co.il)
Fri, 17 Jul 1998 14:55:50 +0300

This is a multi-part message in MIME format.
--------------C812E0B857230903B5B06B7B
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

1. I sent a similar report some time ago.. the panic still happens.
The problem is when unmapping the last part (but not all) of
a segment acquired by shmget + shmat. Ref count goes down to 0
and then the segment is reused!!
2. User canot see his own Shared Memory Segments using "ipcs".
(the user can remove them. They are only visible by root).

Itai

-- 
Itai Nahshon   nahshon@actcom.co.il
        Also   nahshon@vnet.ibm.com
--------------C812E0B857230903B5B06B7B
Content-Type: text/plain; charset=us-ascii; name="shm-test.c"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="shm-test.c"


#include <sys/types.h>
#include <fcntl.h>
#include <sys/ipc.h>
#include <sys/shm.h>


main() {
	int shmid;
	char *addr;


	shmid = shmget(12342, 1024*1024, IPC_CREAT|0777);
	if(shmid < 0) {
		perror("shmget");
		exit(0);
	}


	printf("shmid = %d\n", shmid);


	addr = shmat(shmid, NULL, 0);


	strcpy(addr, "Hello world! test1");


	if (shmctl(shmid, IPC_RMID, NULL) < 0) {
		perror("shmctl IPC_RMID");
		exit(0);
	}


	strcpy(addr, "Hello world! test2");


        /* Remove just the last 4K of the segment.
	   This will trigger the panic. */
	if(munmap(addr+1024*1020, 1024*4) < 0) {
		perror("munmap");
		exit(0);
	}


	strcpy(addr, "Hello world! test3");


	sleep(100);
}


--------------C812E0B857230903B5B06B7B--




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html