Messages in this thread | | | Date | Thu, 12 Sep 2013 17:10:01 +0200 | From | Manfred Spraul <> | Subject | Re: [PATCH] ipc,msg: shorten critical region in msgsnd |
| |
Hi all,
On 09/12/2013 02:20 PM, Manfred Spraul wrote: > > And: What about the other users of obtain_object_check? > exit_sem() is also quite long, but I didn't spot any obvious problems. > a) I think semtimed(), msgsnd() and msgrcv() must be fixed: They either leak memory or tasks can sleep forever. I haven't checked the shm code, I would expect that there are similar problems.
b) There are additional races at least with selinux: security/selinux/hooks.c - selinux_sem_semop() accesses sma->sem_perm.security->sid. - selinux_sem_free_security() does kfree() q_perm.security.
Right now, both operations can happen in parallel -> use after free.
I think the security_xx_yy() calls within ipc/*.c must only be called: - after checking _perm.deleted - with ipc_perm.lock acquired (to prevent parallel RMID calls).
Davidlohr: What would be your proposal?
-- Manfred
| |