Messages in this thread | | | Date | Tue, 10 Jul 2018 15:08:30 -0700 | From | Davidlohr Bueso <> | Subject | Re: [PATCH 01/12] ipc: reorganize initialization of kern_ipc_perm.id |
| |
On Mon, 09 Jul 2018, Manfred Spraul wrote:
>ipc_addid() initializes kern_ipc_perm.id after having called >ipc_idr_alloc(). > >Thus a parallel semop() or msgrcv() that uses ipc_obtain_object_idr() >may see an uninitialized value. > >The patch moves all accesses to kern_ipc_perm.id under the spin_lock().
Yeah this is a lot better than my kzalloc() idea. I was considering completions to avoid these races with ->getnew(), but careful init beats that idea for obvious reasons.
The only thing I would say is that the title should be more descriptive. Unlike the next patch, this one isn't really reorganizing anything. How about:
ipc: compute kern_ipc_perm.id under the ipc lock for stat cmds
> >The issues is related to the finding of >syzbot+2827ef6b3385deb07eaf@syzkaller.appspotmail.com: >syzbot found an issue with kern_ipc_perm.seq > >Signed-off-by: Manfred Spraul <manfred@colorfullife.com> >Cc: Dmitry Vyukov <dvyukov@google.com> >Cc: Kees Cook <keescook@chromium.org> >Cc: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Davidlohr Bueso <dbueso@suse.de>
| |