Accessing memory after shm_unlink

Question

Operation of shm_unlink is unclear for me. I have created a shared memory object and mapped to a process. Later, I did shm_unlink to the memory object. Following shm_unlink, I was able to access the same memory for read and write. How is that possible? As the memory object was destroyed by shm_unlink, I was expecting a segmentation fault in this case. But, it didn't happen? What is the reason? What does shm_unlink exactly doing here?

Below is code snippet.

main(int argc, char * argv[])
{
    int   fd;
    char  *addr;
    int i = 0;

    /*
    * In case the unlink code isn't executed at the end
    */
    if (argc != 1) {
        shm_unlink("/bolts");
        return EXIT_SUCCESS;
    }

    /* Create a new memory object */
    fd = shm_open("/bolts", O_RDWR | O_CREAT, 0666);
    if (fd == -1) {
        fprintf(stderr, "Open failed : %s\n",
            strerror(errno));
        return EXIT_FAILURE;
    }

    /* Set the memory object's size */
    if (ftruncate(fd, 1024) == -1) {
        fprintf(stderr, "ftruncate : %s\n", strerror(errno));
        return EXIT_FAILURE;
    }

    addr = mmap(0, 1024, PROT_READ | PROT_WRITE,
        MAP_SHARED, fd, 0);

    if (addr == MAP_FAILED) {
        fprintf(stderr, "mmap failed:%s\n", strerror(errno));
        return EXIT_FAILURE;
    }

    sleep(10);

    printf("Map addr is %x\n",(unsigned int) addr);

    if (fork())
    {
        sleep(10);
        strcpy (addr, "Sreehari in parent\n");
    }
    else
    {
        strcpy(addr,  "I am in child\n");

    }

    sleep(6);
    i = shm_unlink("/bolts");

    printf("addr is %s, i is %d \n", addr, i);
    return EXIT_SUCCESS;
}

Answer 1

shm_open/shm_unlink does not directly affect memory mappings, this has to be done with corresponding mmap/munmap-calls.

shm_unlink removes a Posix shared memory segment from the shm-filesystem and if the last mapping is removed, the actual memory is destroyed.

Answer 2

shm_open creates a named shared memory object. Any process can map that shared memory object using a name passed to shm_open. shm_unlink removes that name, so shared memory region cannot be mapped anymore, but actual memory is useable until unmapped. Note that this is analogous to unlink: you may use open()ed file after unlink()ing it, and actual file contents will be freed after last file descriptor is close()d.

According to manual page:

The operation of shm_unlink() is analogous to unlink(2): it removes a shared memory object name, and, once all processes have unmapped the object, de-allocates and destroys the contents of the associated memory region. After a successful shm_unlink(), attempts to shm_open() an object with the same name will fail (unless O_CREAT was specified, in which case a new, distinct object is created).