lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Sun, 30 Jul 2017 13:35:28 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Manfred Spraul <manfred@...orfullife.com>,
        Davidlohr Bueso <dave@...olabs.net>,
        Miklos Szeredi <mszeredi@...hat.com>,
        Shailesh Pandey <p.shailesh@...sung.com>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        Dominik Brodowski <linux@...inikbrodowski.net>,
        LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] ipc/shm: Add missing container_of() for randstruct

When building with the randstruct gcc plugin, the layout of the shm struct
will be randomized, which requires any sub-structure accesses to use
container_of(). One was still missing in the proc display handler, which
would lead to crashes when running the "lsipc" program after the system
had shm registers (e.g. after starting up Gnome):

[  183.018415] general protection fault: 0000 [#1] PREEMPT SMP
...
[  183.018692] RIP: 0010:shm_add_rss_swap.isra.1+0x13/0xa0
...
[  183.019265] Call Trace:
[  183.019294]  sysvipc_shm_proc_show+0x5e/0x150
[  183.019338]  ? _raw_spin_lock+0x17/0x40
[  183.019376]  ? sysvipc_find_ipc+0xbc/0xf0
[  183.019416]  sysvipc_proc_show+0x1a/0x30
[  183.019456]  seq_read+0x2e9/0x3f0
...

Reported-by: Dominik Brodowski <linux@...inikbrodowski.net>
Cc: Manfred Spraul <manfred@...orfullife.com>
Fixes: 3859a271a003 ("randstruct: Mark various structs for randomization")
Signed-off-by: Kees Cook <keescook@...omium.org>
---
Hi Andrew, please take this as a fix for v4.13.
---
 ipc/shm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ipc/shm.c b/ipc/shm.c
index 28a444861a8f..8828b4c3a190 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1380,9 +1380,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 {
 	struct user_namespace *user_ns = seq_user_ns(s);
-	struct shmid_kernel *shp = it;
+	struct kern_ipc_perm *ipcp = it;
+	struct shmid_kernel *shp;
 	unsigned long rss = 0, swp = 0;
 
+	shp = container_of(ipcp, struct shmid_kernel, shm_perm);
 	shm_add_rss_swap(shp, &rss, &swp);
 
 #if BITS_PER_LONG <= 32
-- 
2.7.4


-- 
Kees Cook
Pixel Security

Powered by blists - more mailing lists