linux-kernel - Re: [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace was changed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 9 Jul 2021 18:12:41 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Alexander Mikhalitsyn <alexander.mikhalitsyn@...tuozzo.com>
Cc:     linux-kernel@...r.kernel.org, Milton Miller <miltonm@....com>,
        Jack Miller <millerjo@...ibm.com>,
        Pavel Tikhomirov <ptikhomirov@...tuozzo.com>,
        Alexander Mikhalitsyn <alexander@...alicyn.com>,
        Manfred Spraul <manfred@...orfullife.com>,
        Davidlohr Bueso <dave@...olabs.net>,
        Johannes Weiner <hannes@...xchg.org>,
        Michal Hocko <mhocko@...e.com>,
        Vladimir Davydov <vdavydov.dev@...il.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: [PATCH 0/2] shm: omit forced shm destroy if task IPC namespace
 was changed

On Tue,  6 Jul 2021 16:22:57 +0300 Alexander Mikhalitsyn <alexander.mikhalitsyn@...tuozzo.com> wrote:

> Hello,
> 
> Task IPC namespace shm's has shm_rmid_forced feature which is per IPC namespace
> and controlled by kernel.shm_rmid_forced sysctl. When feature is turned on,
> then during task exit (and unshare(CLONE_NEWIPC)) all sysvshm's will be destroyed
> by exit_shm(struct task_struct *task) function. But there is a problem if task
> was changed IPC namespace since shmget() call. In such situation exit_shm() function
> will try to call
> shm_destroy(<new_ipc_namespace_ptr>, <sysvshmem_from_old_ipc_namespace>)
> which leads to the situation when sysvshm object still attached to old
> IPC namespace but freed; later during old IPC namespace cleanup we will try to
> free such sysvshm object for the second time and will get the problem :)
> 
> First patch solves this problem by postponing shm_destroy to the moment when
> IPC namespace cleanup will be called.
> Second patch is useful to prevent (or easy catch) such bugs in the future by
> adding corresponding WARNings.
> 

(cc's added)

I assume that a

Fixes: b34a6b1da371ed8af ("ipc: introduce shm_rmid_forced sysctl") is
appropriate here?

A double-free is serious.  Should this fix be backported into earlier
kernels?