On Tue, Nov 30, 2021 at 10:56:07AM +0100, Manfred Spraul wrote:
> Hi,
>
> On 11/29/21 20:47, Alexander Mikhalitsyn wrote:
> > For 4.14.y:
> >
> > Upstream commit 85b6d24646e4 ("shm: extend forced shm destroy to support objects from several IPC nses")
> >
> > Currently, the exit_shm() function not designed to work properly when
> > task->sysvshm.shm_clist holds shm objects from different IPC namespaces.
> >
> > This is a real pain when sysctl kernel.shm_rmid_forced = 1, because it
> > leads to use-after-free (reproducer exists).
> >
> > This is an attempt to fix the problem by extending exit_shm mechanism to
> > handle shm's destroy from several IPC ns'es.
> >
> > To achieve that we do several things:
> >
> > 1. add a namespace (non-refcounted) pointer to the struct shmid_kernel
> >
> > 2. during new shm object creation (newseg()/shmget syscall) we
> > initialize this pointer by current task IPC ns
> >
> > 3. exit_shm() fully reworked such that it traverses over all shp's in
> > task->sysvshm.shm_clist and gets IPC namespace not from current task
> > as it was before but from shp's object itself, then call
> > shm_destroy(shp, ns).
> >
> > Note: We need to be really careful here, because as it was said before
> > (1), our pointer to IPC ns non-refcnt'ed. To be on the safe side we
> > using special helper get_ipc_ns_not_zero() which allows to get IPC ns
> > refcounter only if IPC ns not in the "state of destruction".
> >
> > Q/A
> >
> > Q: Why can we access shp->ns memory using non-refcounted pointer?
> > A: Because shp object lifetime is always shorther than IPC namespace
> > lifetime, so, if we get shp object from the task->sysvshm.shm_clist
> > while holding task_lock(task) nobody can steal our namespace.
> >
> > Q: Does this patch change semantics of unshare/setns/clone syscalls?
> > A: No. It's just fixes non-covered case when process may leave IPC
> > namespace without getting task->sysvshm.shm_clist list cleaned up.
> >
> > Link: https://lkml.kernel.org/r/67bb03e5-f79c-1815-e2bf-949c67047418@xxxxxxxxxxxxxxxx
> > Link: https://lkml.kernel.org/r/20211109151501.4921-1-manfred@xxxxxxxxxxxxxxxx
> > Fixes: ab602f79915 ("shm: make exit_shm work proportional to task activity")
> > Co-developed-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
> > Signed-off-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
> > Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@xxxxxxxxxxxxx>
> > Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
> > Cc: Davidlohr Bueso <dave@xxxxxxxxxxxx>
> > Cc: Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx>
> > Cc: Andrei Vagin <avagin@xxxxxxxxx>
> > Cc: Pavel Tikhomirov <ptikhomirov@xxxxxxxxxxxxx>
> > Cc: Vasily Averin <vvs@xxxxxxxxxxxxx>
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> > Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>
> > ---
> > include/linux/ipc_namespace.h | 15 +++
> > include/linux/sched/task.h | 2 +-
> > include/linux/shm.h | 13 ++-
> > ipc/shm.c | 176 +++++++++++++++++++++++++---------
> > 4 files changed, 159 insertions(+), 47 deletions(-)
>
> Tested ok: The crash is resolved, no observed degradations.
Now queued up, thanks.
greg k-h
