On Mon, 09 Jul 2018, Manfred Spraul wrote:
ipc_addid() initializes kern_ipc_perm.id after having called
ipc_idr_alloc().
Thus a parallel semop() or msgrcv() that uses ipc_obtain_object_idr()
may see an uninitialized value.
The patch moves all accesses to kern_ipc_perm.id under the spin_lock().
Yeah this is a lot better than my kzalloc() idea. I was considering
completions to avoid these races with ->getnew(), but careful init beats
that idea for obvious reasons.
The only thing I would say is that the title should be more descriptive.
Unlike the next patch, this one isn't really reorganizing anything.
How about:
ipc: compute kern_ipc_perm.id under the ipc lock for stat cmds
The issues is related to the finding of
syzbot+2827ef6b3385deb07...@syzkaller.appspotmail.com:
syzbot found an issue with kern_ipc_perm.seq
Signed-off-by: Manfred Spraul <manf...@colorfullife.com>
Cc: Dmitry Vyukov <dvyu...@google.com>
Cc: Kees Cook <keesc...@chromium.org>
Cc: Davidlohr Bueso <d...@stgolabs.net>
Reviewed-by: Davidlohr Bueso <dbu...@suse.de>
