Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 6 Mar 2009 16:27:39 +0800
From: Eugene Teo <>
Cc: "Steven M. Christey" <>
Subject: CVE request: kernel: shm: fix shmctl(SHM_INFO) lockup with 

According to the upstream commit
a68e61e8ff2d46327a37b69056998b47745db6fa, shm_get_stat() assumes that
the inode is a "struct shmem_inode_info", which is incorrect for
!CONFIG_SHMEM (see fs/ramfs/inode.c: ramfs_get_inode() vs.
mm/shmem.c: shmem_get_inode()).

This bad assumption can cause shmctl(SHM_INFO) to lockup when
shm_get_stat() tries to spin_lock(&info->lock).  Users of
!CONFIG_SHMEM may encounter this lockup simply by invoking the 'ipcs'

Reported by Jiri Olsa back in February 2008:

Thanks, Eugene

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ