linux-hardened/ipc
Manfred Spraul c626bc46ed ipc/sem.c: fix incorrect sem_lock pairing
Based on the syzcaller test case from dvyukov:

  08d0a261fe/gistfile1.txt

The slow (i.e.: failure to acquire) syscall exit from semtimedop()
incorrectly assumed that the the same lock is acquired as it was at the
initial syscall entry.

This is wrong:
 - thread A: single semop semop(), sleeps
 - thread B: multi semop semop(), sleeps
 - thread A: woken up by signal/timeout

With this sequence, the initial sem_lock() call locks the per-semaphore
spinlock, and it is unlocked with sem_unlock().  The call at the syscall
return locks the global spinlock.  Because locknum is not updated, the
following sem_unlock() call unlocks the per-semaphore spinlock, which is
actually not locked.

The fix is trivial: Use the return value from sem_lock.

Fixes: 370b262c89 ("ipc/sem: avoid idr tree lookup for interrupted semop")
Link: http://lkml.kernel.org/r/1482215645-22328-1-git-send-email-manfred@colorfullife.com
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Johanna Abrahamsson <johanna@mjao.org>
Tested-by: Johanna Abrahamsson <johanna@mjao.org>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2017-01-10 18:31:55 -08:00
..
compat.c ipc: resolve shadow warnings 2014-10-14 02:18:23 +02:00
compat_mq.c ipc, kernel: use Linux headers 2014-06-06 16:08:14 -07:00
ipc_sysctl.c ipc/msg: increase MSGMNI, remove scaling 2014-12-13 12:42:52 -08:00
Makefile ipc/msg: increase MSGMNI, remove scaling 2014-12-13 12:42:52 -08:00
mq_sysctl.c ipc: convert use of typedef ctl_table to struct ctl_table 2014-06-06 16:08:16 -07:00
mqueue.c sched/wake_q: Rename WAKE_Q to DEFINE_WAKE_Q 2016-11-21 10:29:01 +01:00
msg.c ipc: msg, make msgrcv work with LONG_MIN 2016-12-14 16:04:08 -08:00
msgutil.c ipc: account for kmem usage on mqueue and msg 2016-10-27 18:43:43 -07:00
namespace.c Merge branch 'nsfs-ioctls' into HEAD 2016-09-22 20:00:36 -05:00
sem.c ipc/sem.c: fix incorrect sem_lock pairing 2017-01-10 18:31:55 -08:00
shm.c ipc/shm.c: coding style fixes 2016-12-14 16:04:08 -08:00
syscall.c get rid of union semop in sys_semctl(2) arguments 2013-03-05 15:14:16 -05:00
util.c tree wide: use kvfree() than conditional kfree()/vfree() 2016-01-22 17:02:18 -08:00
util.h tree wide: use kvfree() than conditional kfree()/vfree() 2016-01-22 17:02:18 -08:00