tree 0169510392ae190dcec4376a7341efe955fa27fd
parent 0050ee059f7fc86b1df2527aaa14ed5dc72f9973
author Dave Hansen <dave.hansen@linux.intel.com> 1418432299 -0800
committer Linus Torvalds <torvalds@linux-foundation.org> 1418503372 -0800

ipc/shm.c: fix overly aggressive shmdt() when calls span multiple segments

This is a highly-contrived scenario.  But, a single shmdt() call can be
induced in to unmapping memory from mulitple shm segments.  Example code
is here:

	http://www.sr71.net/~dave/intel/shmfun.c

The fix is pretty simple: Record the 'struct file' for the first VMA we
encounter and then stick to it.  Decline to unmap anything not from the
same file and thus the same segment.

I found this by inspection and the odds of anyone hitting this in practice
are pretty darn small.

Lightly tested, but it's a pretty small patch.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>