The patch titled
Subject: ipc/util.c: use ipc_rcu_putref() for failues in ipc_addid()
has been added to the -mm tree. Its filename is
ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Subject: ipc/util.c: use ipc_rcu_putref() for failues in ipc_addid()
ipc_addid() is impossible to use:
- for certain failures, the caller must not use ipc_rcu_putref(),
because the reference counter is not yet initialized.
- for other failures, the caller must use ipc_rcu_putref(), because
parallel operations could be ongoing already.
The patch cleans that up, by initializing the refcount early, and by
modifying all callers.
The issues is related to the finding of
syzbot+2827ef6b3385deb07eaf@xxxxxxxxxxxxxxxxxxxxxxxxx: syzbot found an
issue with reading kern_ipc_perm.seq, here both read and write to already
released memory could happen.
Link: http://lkml.kernel.org/r/20180709151019.1336-4-manfred@xxxxxxxxxxxxxxxx
Signed-off-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Cc: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Cc: Michael Kerrisk <mtk.manpages@xxxxxxxxx>
Cc: Michal Hocko <mhocko@xxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
ipc/msg.c | 2 +-
ipc/sem.c | 2 +-
ipc/shm.c | 2 ++
ipc/util.c | 12 ++++++++++--
4 files changed, 14 insertions(+), 4 deletions(-)
diff -puN ipc/msg.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid ipc/msg.c
--- a/ipc/msg.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid
+++ a/ipc/msg.c
@@ -162,7 +162,7 @@ static int newque(struct ipc_namespace *
/* ipc_addid() locks msq upon success. */
retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
if (retval < 0) {
- call_rcu(&msq->q_perm.rcu, msg_rcu_free);
+ ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
return retval;
}
diff -puN ipc/sem.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid ipc/sem.c
--- a/ipc/sem.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid
+++ a/ipc/sem.c
@@ -556,7 +556,7 @@ static int newary(struct ipc_namespace *
/* ipc_addid() locks sma upon success. */
retval = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
if (retval < 0) {
- call_rcu(&sma->sem_perm.rcu, sem_rcu_free);
+ ipc_rcu_putref(&sma->sem_perm, sem_rcu_free);
return retval;
}
ns->used_sems += nsems;
diff -puN ipc/shm.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid ipc/shm.c
--- a/ipc/shm.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid
+++ a/ipc/shm.c
@@ -671,6 +671,8 @@ no_id:
if (is_file_hugepages(file) && shp->mlock_user)
user_shm_unlock(size, shp->mlock_user);
fput(file);
+ ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
+ return error;
no_file:
call_rcu(&shp->shm_perm.rcu, shm_rcu_free);
return error;
diff -puN ipc/util.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid ipc/util.c
--- a/ipc/util.c~ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid
+++ a/ipc/util.c
@@ -248,7 +248,9 @@ static inline void ipc_set_seq(struct ip
* Add an entry 'new' to the ipc ids idr. The permissions object is
* initialised and the first free entry is set up and the id assigned
* is returned. The 'new' entry is returned in a locked state on success.
+ *
* On failure the entry is not locked and a negative err-code is returned.
+ * The caller must use ipc_rcu_putref() to free the identifier.
*
* Called with writer ipc_ids.rwsem held.
*/
@@ -258,6 +260,9 @@ int ipc_addid(struct ipc_ids *ids, struc
kgid_t egid;
int id, err;
+ /* 1) Initialize the refcount so that ipc_rcu_putref works */
+ refcount_set(&new->refcount, 1);
+
if (limit > IPCMNI)
limit = IPCMNI;
@@ -266,9 +271,7 @@ int ipc_addid(struct ipc_ids *ids, struc
idr_preload(GFP_KERNEL);
- refcount_set(&new->refcount, 1);
spin_lock_init(&new->lock);
- new->deleted = false;
rcu_read_lock();
spin_lock(&new->lock);
@@ -277,6 +280,7 @@ int ipc_addid(struct ipc_ids *ids, struc
new->gid = new->cgid = egid;
ipc_set_seq(ids, new);
+ new->deleted = false;
/*
* As soon as a new object is inserted into the idr,
@@ -288,6 +292,9 @@ int ipc_addid(struct ipc_ids *ids, struc
* Thus the object must be fully initialized, and if something fails,
* then the full tear-down sequence must be followed.
* (i.e.: set new->deleted, reduce refcount, call_rcu())
+ *
+ * This function sets new->deleted, the caller must use ipc_rcu_putef()
+ * for the remaining steps.
*/
id = ipc_idr_alloc(ids, new);
idr_preload_end();
@@ -301,6 +308,7 @@ int ipc_addid(struct ipc_ids *ids, struc
}
}
if (id < 0) {
+ new->deleted = true;
spin_unlock(&new->lock);
rcu_read_unlock();
return id;
_
Patches currently in -mm which might be from manfred@xxxxxxxxxxxxxxxx are
ipc-reorganize-initialization-of-kern_ipc_permid.patch
ipc-reorganize-initialization-of-kern_ipc_permseq.patch
ipc-utilc-use-ipc_rcu_putref-for-failues-in-ipc_addid.patch
ipc-rename-ipcctl_pre_down_nolock.patch
ipc-utilc-correct-comment-in-ipc_obtain_object_check.patch
ipc-rename-ipc_lock-to-ipc_lock_idr.patch
ipc-utilc-further-ipc_idr_alloc-cleanups.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
