From: Davidlohr Bueso <davidlohr@hp.com>
To: Manfred Spraul <manfred@colorfullife.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Rik van Riel <riel@redhat.com>, Mike Galbraith <efault@gmx.de>,
sedat.dilek@gmail.com,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Davidlohr Bueso <davidlohr@hp.com>,
stable@vger.kernel.org, #@domain.invalid, for@domain.invalid,
3.11@domain.invalid
Subject: [PATCH 3/4] ipc,msg: fix race with selinux
Date: Sun, 15 Sep 2013 20:04:36 -0700 [thread overview]
Message-ID: <1379300677-24188-4-git-send-email-davidlohr@hp.com> (raw)
In-Reply-To: <1379300677-24188-1-git-send-email-davidlohr@hp.com>
Currently, we check msg security only under RCU. Since selinux
can free the security structure, through selinux_sem_free_security(),
we can run into a use-after-free condition. This bug only affects
msgctl syscalls, as msgsnd and msgrcv have already been updated.
The fix is obvious, make sure we hold the kern_ipc_perm.lock while
performing these security checks.
Reported-by: Manfred Spraul <manfred@colorfullife.com>
Cc: stable@vger.kernel.org # for 3.11
Signed-off-by: Davidlohr Bueso <davidlohr@hp.com>
---
ipc/msg.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/ipc/msg.c b/ipc/msg.c
index b0d541d4..06e8aae 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -414,13 +414,13 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
msq = container_of(ipcp, struct msg_queue, q_perm);
+ ipc_lock_object(&msq->q_perm);
err = security_msg_queue_msgctl(msq, cmd);
if (err)
- goto out_unlock1;
+ goto out_unlock0;
switch (cmd) {
case IPC_RMID:
- ipc_lock_object(&msq->q_perm);
/* freeque unlocks the ipc object and rcu */
freeque(ns, ipcp);
goto out_up;
@@ -428,10 +428,9 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
if (msqid64.msg_qbytes > ns->msg_ctlmnb &&
!capable(CAP_SYS_RESOURCE)) {
err = -EPERM;
- goto out_unlock1;
+ goto out_unlock0;
}
- ipc_lock_object(&msq->q_perm);
err = ipc_update_perm(&msqid64.msg_perm, ipcp);
if (err)
goto out_unlock0;
@@ -450,7 +449,6 @@ static int msgctl_down(struct ipc_namespace *ns, int msqid, int cmd,
break;
default:
err = -EINVAL;
- goto out_unlock1;
}
out_unlock0:
@@ -542,9 +540,12 @@ static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
if (ipcperms(ns, &msq->q_perm, S_IRUGO))
goto out_unlock;
+ ipc_lock_object(&msq->q_perm);
err = security_msg_queue_msgctl(msq, cmd);
- if (err)
+ if (err) {
+ ipc_unlock_object(&msq->q_perm);
goto out_unlock;
+ }
kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
tbuf.msg_stime = msq->q_stime;
@@ -556,6 +557,7 @@ static int msgctl_nolock(struct ipc_namespace *ns, int msqid,
tbuf.msg_lspid = msq->q_lspid;
tbuf.msg_lrpid = msq->q_lrpid;
rcu_read_unlock();
+ ipc_unlock_object(&msq->q_perm);
if (copy_msqid_to_user(buf, &tbuf, version))
return -EFAULT;
--
1.7.11.7
next prev parent reply other threads:[~2013-09-16 3:04 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-16 3:04 [PATCH 0/4] ipc: shm and msg fixes Davidlohr Bueso
2013-09-16 3:04 ` [PATCH 1/4] ipc,shm: fix race with selinux Davidlohr Bueso
2013-09-16 9:23 ` Manfred Spraul
2013-09-16 3:04 ` [PATCH 2/4] ipc,shm: prevent race with rmid in shmat(2) Davidlohr Bueso
2013-09-27 5:45 ` Manfred Spraul
2013-09-27 23:40 ` Davidlohr Bueso
2013-09-16 3:04 ` Davidlohr Bueso [this message]
2013-09-16 3:04 ` [PATCH 4/4] ipc,msg: prevent race with rmid in msgsnd,msgrcv Davidlohr Bueso
2013-09-27 5:50 ` Manfred Spraul
2013-09-19 21:22 ` [PATCH 0/4] ipc: shm and msg fixes Davidlohr Bueso
2013-09-20 18:08 ` Eric Paris
2013-09-21 18:30 ` Davidlohr Bueso
2013-09-21 18:58 ` Linus Torvalds
2013-09-23 6:42 ` Davidlohr Bueso
2013-09-23 16:54 ` Linus Torvalds
2013-09-24 0:04 ` Davidlohr Bueso
2013-09-24 1:22 ` Linus Torvalds
2013-09-24 8:49 ` Manfred Spraul
2013-09-24 9:05 ` Manfred Spraul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1379300677-24188-4-git-send-email-davidlohr@hp.com \
--to=davidlohr@hp.com \
--cc=#@domain.invalid \
--cc=3.11@domain.invalid \
--cc=akpm@linux-foundation.org \
--cc=efault@gmx.de \
--cc=for@domain.invalid \
--cc=linux-kernel@vger.kernel.org \
--cc=manfred@colorfullife.com \
--cc=riel@redhat.com \
--cc=sedat.dilek@gmail.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®