[patch 13/16] ipc: add missing container_of()s for randstruct

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: ipc: add missing container_of()s for randstruct

When building with the randstruct gcc plugin, the layout of the IPC
structs will be randomized, which requires any sub-structure accesses to
use container_of().  The proc display handlers were missing the needed
container_of()s since the iterator is passing in the top-level struct
kern_ipc_perm.  This would lead to crashes when running the "lsipc"
program after the system had IPC registered (e.g.  after starting up
Gnome):

[  183.018415] general protection fault: 0000 [#1] PREEMPT SMP
...
[  183.018692] RIP: 0010:shm_add_rss_swap.isra.1+0x13/0xa0
...
[  183.019265] Call Trace:
[  183.019294]  sysvipc_shm_proc_show+0x5e/0x150
[  183.019338]  ? _raw_spin_lock+0x17/0x40
[  183.019376]  ? sysvipc_find_ipc+0xbc/0xf0
[  183.019416]  sysvipc_proc_show+0x1a/0x30
[  183.019456]  seq_read+0x2e9/0x3f0
...

Link: http://lkml.kernel.org/r/20170730205950.GA55841@beast
Fixes: 3859a271a003 ("randstruct: Mark various structs for randomization")
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Reported-by: Dominik Brodowski <linux@xxxxxxxxxxxxxxxxxxxx>
Acked-by: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Acked-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 ipc/msg.c |    3 ++-
 ipc/sem.c |    3 ++-
 ipc/shm.c |    4 +++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff -puN ipc/msg.c~ipc-add-missing-container_ofs-for-randstruct ipc/msg.c
--- a/ipc/msg.c~ipc-add-missing-container_ofs-for-randstruct
+++ a/ipc/msg.c
@@ -1034,7 +1034,8 @@ void msg_exit_ns(struct ipc_namespace *n
 static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
 {
 	struct user_namespace *user_ns = seq_user_ns(s);
-	struct msg_queue *msq = it;
+	struct kern_ipc_perm *ipcp = it;
+	struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 
 	seq_printf(s,
 		   "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
diff -puN ipc/sem.c~ipc-add-missing-container_ofs-for-randstruct ipc/sem.c
--- a/ipc/sem.c~ipc-add-missing-container_ofs-for-randstruct
+++ a/ipc/sem.c
@@ -2179,7 +2179,8 @@ void exit_sem(struct task_struct *tsk)
 static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
 {
 	struct user_namespace *user_ns = seq_user_ns(s);
-	struct sem_array *sma = it;
+	struct kern_ipc_perm *ipcp = it;
+	struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm);
 	time_t sem_otime;
 
 	/*
diff -puN ipc/shm.c~ipc-add-missing-container_ofs-for-randstruct ipc/shm.c
--- a/ipc/shm.c~ipc-add-missing-container_ofs-for-randstruct
+++ a/ipc/shm.c
@@ -1380,9 +1380,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, sh
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 {
 	struct user_namespace *user_ns = seq_user_ns(s);
-	struct shmid_kernel *shp = it;
+	struct kern_ipc_perm *ipcp = it;
+	struct shmid_kernel *shp;
 	unsigned long rss = 0, swp = 0;
 
+	shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 	shm_add_rss_swap(shp, &rss, &swp);
 
 #if BITS_PER_LONG <= 32
_
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Kernel Archive]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]

  Powered by Linux