lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 30 Jul 2017 13:35:28 -0700 From: Kees Cook <keescook@...omium.org> To: Andrew Morton <akpm@...ux-foundation.org> Cc: Manfred Spraul <manfred@...orfullife.com>, Davidlohr Bueso <dave@...olabs.net>, Miklos Szeredi <mszeredi@...hat.com>, Shailesh Pandey <p.shailesh@...sung.com>, Mike Rapoport <rppt@...ux.vnet.ibm.com>, Dominik Brodowski <linux@...inikbrodowski.net>, LKML <linux-kernel@...r.kernel.org> Subject: [PATCH] ipc/shm: Add missing container_of() for randstruct When building with the randstruct gcc plugin, the layout of the shm struct will be randomized, which requires any sub-structure accesses to use container_of(). One was still missing in the proc display handler, which would lead to crashes when running the "lsipc" program after the system had shm registers (e.g. after starting up Gnome): [ 183.018415] general protection fault: 0000 [#1] PREEMPT SMP ... [ 183.018692] RIP: 0010:shm_add_rss_swap.isra.1+0x13/0xa0 ... [ 183.019265] Call Trace: [ 183.019294] sysvipc_shm_proc_show+0x5e/0x150 [ 183.019338] ? _raw_spin_lock+0x17/0x40 [ 183.019376] ? sysvipc_find_ipc+0xbc/0xf0 [ 183.019416] sysvipc_proc_show+0x1a/0x30 [ 183.019456] seq_read+0x2e9/0x3f0 ... Reported-by: Dominik Brodowski <linux@...inikbrodowski.net> Cc: Manfred Spraul <manfred@...orfullife.com> Fixes: 3859a271a003 ("randstruct: Mark various structs for randomization") Signed-off-by: Kees Cook <keescook@...omium.org> --- Hi Andrew, please take this as a fix for v4.13. --- ipc/shm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index 28a444861a8f..8828b4c3a190 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1380,9 +1380,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr) static int sysvipc_shm_proc_show(struct seq_file *s, void *it) { struct user_namespace *user_ns = seq_user_ns(s); - struct shmid_kernel *shp = it; + struct kern_ipc_perm *ipcp = it; + struct shmid_kernel *shp; unsigned long rss = 0, swp = 0; + shp = container_of(ipcp, struct shmid_kernel, shm_perm); shm_add_rss_swap(shp, &rss, &swp); #if BITS_PER_LONG <= 32 -- 2.7.4 -- Kees Cook Pixel Security
Powered by blists - more mailing lists