linux-kernel - Re: [PATCH] ipc,msg: shorten critical region in msgsnd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5231B181.7080705@colorfullife.com>
Date:	Thu, 12 Sep 2013 14:20:17 +0200
From:	Manfred Spraul <manfred@...orfullife.com>
To:	davidlohr.bueso@...com
CC:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Rik van Riel <riel@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Sedat Dilek <sedat.dilek@...il.com>
Subject: Re: [PATCH] ipc,msg: shorten critical region in msgsnd

Hi Davidlohr,

I think the patch (3dd1f784ed6603d7ab1043e51e6371235edf2313) is still 
unsafe, i.e. my correction (bebcb928c820d0ee83aca4b192adc195e43e66a2) 
doesn't fix everything:

AFAICS, ipc_obtain_object_check:
- look up the id in the idr tree
- check if it is deleted
- return without taking any locks.

This means that the "is not deleted" information can be stale immediately.

Thus do_msgsnd() in ipc/msg.c contains a memory leak:
>        rcu_read_lock();
>         msq = msq_obtain_object_check(ns, msqid);
>         if (IS_ERR(msq)) {
>                 err = PTR_ERR(msq);
>                 goto out_unlock1;
>         }
<<<< what if the code is preempted here and RMID is processed?
The code below would queue the message into an already removed queue.
The queue is freed by the rcu callback, but the message memory is leaked.

> ipc_lock_object(&msq->q_perm);
>

Is this analysis correct?

And: What about the other users of obtain_object_check?
exit_sem() is also quite long, but I didn't spot any obvious problems.

--
     Manfred
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/