linux-kernel - Re: [PATCH v2] ipc: introduce ipc_valid_object() helper to sort out IPC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Dec 2013 13:11:29 +0100
From:	Manfred Spraul <manfred@...orfullife.com>
To:	Rafael Aquini <aquini@...hat.com>, linux-kernel@...r.kernel.org
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Davidlohr Bueso <davidlohr@...com>,
	Rik van Riel <riel@...hat.com>,
	Greg Thelen <gthelen@...gle.com>
Subject: Re: [PATCH v2] ipc: introduce ipc_valid_object() helper to sort out
 IPC_RMID races

On 12/18/2013 12:28 AM, Rafael Aquini wrote:
> After the locking semantics for the SysV IPC API got improved, a couple of
> IPC_RMID race windows were opened because we ended up dropping the
> 'kern_ipc_perm.deleted' check performed way down in ipc_lock().
> The spotted races got sorted out by re-introducing the old test within
> the racy critical sections.
>
> This patch introduces ipc_valid_object() to consolidate the way we cope with
> IPC_RMID races by using the same abstraction across the API implementation.
>
> Signed-off-by: Rafael Aquini <aquini@...hat.com>
> Acked-by: Rik van Riel <riel@...hat.com>
> Acked-by: Greg Thelen <gthelen@...gle.com>
> ---
> Changelog:
> * v2:
>   - drop assert_spin_locked() from ipc_valid_object() for less overhead
a) sysv ipc is lockless whereever possible, without writing to any 
shared cachelines.
Therefore my first reaction was: No, please leave the assert in. It will 
help us to catch bugs.

b) then I noticed: the assert would be a bug, the comment in front of 
ipc_valid_object() that the caller must hold _perm.lock is wrong:
> @@ -1846,7 +1846,7 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
>   
>   	error = -EIDRM;
>   	locknum = sem_lock(sma, sops, nsops);
> -	if (sma->sem_perm.deleted)
> +	if (!ipc_valid_object(&sma->sem_perm))
>   		goto out_unlock_free;
simple semtimedop() operation do not acquire sem_perm.lock, they only 
acquire the per-semaphore lock and check that sem_perm.lock is not held. 
This is sufficient to prevent races with RMID.

Could you update the comment?
[...]
> @@ -1116,7 +1116,7 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
>   	ipc_lock_object(&shp->shm_perm);
>   
>   	/* check if shm_destroy() is tearing down shp */
> -	if (shp->shm_file == NULL) {
> +	if (!ipc_valid_object(&shp->shm_perm)) {
>   		ipc_unlock_object(&shp->shm_perm);
>   		err = -EIDRM;
>   		goto out_unlock;
Please mention the change from "shm_file == NULL" to perm.deleted in the 
changelog.
With regards to the impact of this change: No idea, I've never worked on 
the shm code.

--
     Manfred
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/