| commit | 615c999cd8a07b7c3c93bbdee89ef705d2ce52e1 | [log] [tgz] |
|---|---|---|
| author | Manfred Spraul <[email protected]> | Tue Aug 21 22:01:21 2018 -0700 |
| committer | Linus Torvalds <[email protected]> | Wed Aug 22 10:52:51 2018 -0700 |
| tree | 9a61d371b17498dead9ff9136ebd25402bab82fa | |
| parent | 5cb366bb3a746f6b06ea086b322e21e345401c9d [diff] |
ipc: compute kern_ipc_perm.id under the ipc lock ipc_addid() initializes kern_ipc_perm.id after having called ipc_idr_alloc(). Thus a parallel semctl() or msgctl() that uses e.g. MSG_STAT may use this unitialized value as the return code. The patch moves all accesses to kern_ipc_perm.id under the spin_lock(). The issues is related to the finding of [email protected]: syzbot found an issue with kern_ipc_perm.seq Link: http://lkml.kernel.org/r/[email protected] Signed-off-by: Manfred Spraul <[email protected]> Reviewed-by: Davidlohr Bueso <[email protected]> Cc: Dmitry Vyukov <[email protected]> Cc: Kees Cook <[email protected]> Cc: Davidlohr Bueso <[email protected]> Cc: Herbert Xu <[email protected]> Cc: Michael Kerrisk <[email protected]> Cc: Michal Hocko <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>