ipc/util.c: use ipc_rcu_putref() for failues in ipc_addid()

ipc_addid() is impossible to use:
- for certain failures, the caller must not use ipc_rcu_putref(),
  because the reference counter is not yet initialized.
- for other failures, the caller must use ipc_rcu_putref(),
  because parallel operations could be ongoing already.

The patch cleans that up, by initializing the refcount early, and by
modifying all callers.

The issues is related to the finding of
syzbot+2827ef6b3385deb07eaf@syzkaller.appspotmail.com: syzbot found an
issue with reading kern_ipc_perm.seq, here both read and write to already
released memory could happen.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Manfred Spraul <[email protected]>
Cc: Dmitry Vyukov <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Davidlohr Bueso <[email protected]>
Cc: Davidlohr Bueso <[email protected]>
Cc: Herbert Xu <[email protected]>
Cc: Michael Kerrisk <[email protected]>
Cc: Michal Hocko <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/ipc/msg.c b/ipc/msg.c
index 7cb89a9b24e2036f614e214352ae05e64c0317bf..3132aa27ff88b05b7af0047cdcab6bb26537514a 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -163,7 +163,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
        /* ipc_addid() locks msq upon success. */
        retval = ipc_addid(&msg_ids(ns), &msq->q_perm, ns->msg_ctlmni);
        if (retval < 0) {
-               call_rcu(&msq->q_perm.rcu, msg_rcu_free);
+               ipc_rcu_putref(&msq->q_perm, msg_rcu_free);
                return retval;
        }
 

diff --git a/ipc/sem.c b/ipc/sem.c
index 18e50f464f762e954dd3bcccf1e57f6591ea4541..8e72037b894ae9035e6826ac75ec318d68e191b9 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -557,7 +557,7 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
        /* ipc_addid() locks sma upon success. */
        retval = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
        if (retval < 0) {
-               call_rcu(&sma->sem_perm.rcu, sem_rcu_free);
+               ipc_rcu_putref(&sma->sem_perm, sem_rcu_free);
                return retval;
        }
        ns->used_sems += nsems;

diff --git a/ipc/shm.c b/ipc/shm.c
index b3b089315d3bfc192536d9041cd6fcac0a9cf03a..6e7bd98305493705e426d4ae8420346bcd7679d2 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -684,6 +684,8 @@ no_id:
        if (is_file_hugepages(file) && shp->mlock_user)
                user_shm_unlock(size, shp->mlock_user);
        fput(file);
+       ipc_rcu_putref(&shp->shm_perm, shm_rcu_free);
+       return error;
 no_file:
        call_rcu(&shp->shm_perm.rcu, shm_rcu_free);
        return error;

diff --git a/ipc/util.c b/ipc/util.c
index e5c9e2b2e4c471edd878e29290314bbea2c723d9..465bbd21d234287ccf6e18a24811d1387d1b586f 100644 (file)
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -251,7 +251,9 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
  * Add an entry 'new' to the ipc ids idr. The permissions object is
  * initialised and the first free entry is set up and the id assigned
  * is returned. The 'new' entry is returned in a locked state on success.
+ *
  * On failure the entry is not locked and a negative err-code is returned.
+ * The caller must use ipc_rcu_putref() to free the identifier.
  *
  * Called with writer ipc_ids.rwsem held.
  */
@@ -261,6 +263,9 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
        kgid_t egid;
        int idx, err;
 
+       /* 1) Initialize the refcount so that ipc_rcu_putref works */
+       refcount_set(&new->refcount, 1);
+
        if (limit > IPCMNI)
                limit = IPCMNI;
 
@@ -269,9 +274,7 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
 
        idr_preload(GFP_KERNEL);
 
-       refcount_set(&new->refcount, 1);
        spin_lock_init(&new->lock);
-       new->deleted = false;
        rcu_read_lock();
        spin_lock(&new->lock);
 
@@ -279,6 +282,8 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
        new->cuid = new->uid = euid;
        new->gid = new->cgid = egid;
 
+       new->deleted = false;
+
        idx = ipc_idr_alloc(ids, new);
        idr_preload_end();
 
@@ -291,6 +296,7 @@ int ipc_addid(struct ipc_ids *ids, struct kern_ipc_perm *new, int limit)
                }
        }
        if (idx < 0) {
+               new->deleted = true;
                spin_unlock(&new->lock);
                rcu_read_unlock();
                return idx;