Accessing memory after shm_unlink - c

Question

Operation of shm_unlink is unclear for me. I have created a shared memory object and mapped to a process. Later, I did shm_unlink to the memory object. Following shm_unlink, I was able to access the same memory for read and write. How is that possible? As the memory object was destroyed by shm_unlink, I was expecting a segmentation fault in this case. But, it didn't happen? What is the reason? What does shm_unlink exactly doing here?
Below is code snippet.
main(int argc, char * argv[])
{
int fd;
char *addr;
int i = 0;
/*
* In case the unlink code isn't executed at the end
*/
if (argc != 1) {
shm_unlink("/bolts");
return EXIT_SUCCESS;
}
/* Create a new memory object */
fd = shm_open("/bolts", O_RDWR | O_CREAT, 0666);
if (fd == -1) {
fprintf(stderr, "Open failed : %s\n",
strerror(errno));
return EXIT_FAILURE;
}
/* Set the memory object's size */
if (ftruncate(fd, 1024) == -1) {
fprintf(stderr, "ftruncate : %s\n", strerror(errno));
return EXIT_FAILURE;
}
addr = mmap(0, 1024, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, 0);
if (addr == MAP_FAILED) {
fprintf(stderr, "mmap failed:%s\n", strerror(errno));
return EXIT_FAILURE;
}
sleep(10);
printf("Map addr is %x\n",(unsigned int) addr);
if (fork())
{
sleep(10);
strcpy (addr, "Sreehari in parent\n");
}
else
{
strcpy(addr, "I am in child\n");
}
sleep(6);
i = shm_unlink("/bolts");
printf("addr is %s, i is %d \n", addr, i);
return EXIT_SUCCESS;
}

Answer 1

shm_open/shm_unlink does not directly affect memory mappings, this has to be done with corresponding mmap/munmap-calls.
shm_unlink removes a Posix shared memory segment from the shm-filesystem and if the last mapping is removed, the actual memory is destroyed.

Answer 2

shm_open creates a named shared memory object. Any process can map that shared memory object using a name passed to shm_open. shm_unlink removes that name, so shared memory region cannot be mapped anymore, but actual memory is useable until unmapped. Note that this is analogous to unlink: you may use open()ed file after unlink()ing it, and actual file contents will be freed after last file descriptor is close()d.
According to manual page:
The operation of shm_unlink() is analogous to unlink(2): it removes a
shared memory object name, and, once all processes have unmapped the
object, de-allocates and destroys the contents of the associated
memory region. After a successful shm_unlink(), attempts to
shm_open() an object with the same name will fail (unless O_CREAT was
specified, in which case a new, distinct object is created).

Answer 3

As stated in the shm_unlink man page:
"the name shall be removed before shm_unlink() returns, but the removal of the memory object contents shall be postponed until
all open and map references to the shared memory object have been
removed."
This means that the memory may still be there after the unlink.