Jeongjun Park 74bc813d11 ipc: fix to protect IPCS lookups using RCU ... commit d66adabe91 upstream. syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da3 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c@syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510@gmail.com> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Vasiliy Kulikov <segoon@openwall.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-06-27 11:05:26 +01:00
..
compat.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ipc_sysctl.c	ipc: adjust proc_ipc_sem_dointvec definition to match prototype	2020-09-05 12:14:29 -07:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mq_sysctl.c	sysctl: pass kernel pointers to ->proc_handler	2020-04-27 02:07:40 -04:00
mqueue.c	ipc/mqueue: use get_tree_nodev() in mqueue_get_tree()	2022-06-09 10:23:10 +02:00
msg.c	memcg: enable accounting of ipc resources	2021-09-03 09:58:12 -07:00
msgutil.c	ipc: Use generic ns_common::count	2020-08-19 14:13:52 +02:00
namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
sem.c	ipc/sem: Fix dangling sem_array access in semtimedop race	2022-12-08 11:28:45 +01:00
shm.c	ipc: fix to protect IPCS lookups using RCU	2025-06-27 11:05:26 +01:00
syscall.c	y2038: remove CONFIG_64BIT_TIME	2019-11-15 14:38:27 +01:00
util.c	ipc: WARN if trying to remove ipc object which is absent	2021-11-25 09:48:42 +01:00
util.h	ipc/util.c: use binary search for max_idx	2021-07-01 11:06:07 -07:00