MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-08-21 16:31:14 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
v6.12.38
linux-yocto/ipc
History
Jeongjun Park 68c173ea13 ipc: fix to protect IPCS lookups using RCU 
commit d66adabe91 upstream.

syzbot reported that it discovered a use-after-free vulnerability, [0]

[0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/

idr_for_each() is protected by rwsem, but this is not enough.  If it is
not protected by RCU read-critical region, when idr_for_each() calls
radix_tree_node_free() through call_rcu() to free the radix_tree_node
structure, the node will be freed immediately, and when reading the next
node in radix_tree_for_each_slot(), the already freed memory may be read.

Therefore, we need to add code to make sure that idr_for_each() is
protected within the RCU read-critical region when we call it in
shm_destroy_orphaned().

Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com
Fixes: b34a6b1da3 ("ipc: introduce shm_rmid_forced sysctl")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Reported-by: syzbot+a2b84e569d06ca3a949c@syzkaller.appspotmail.com
Cc: Jeongjun Park <aha310510@gmail.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:11:22 +01:00
..
compat.c
ipc_sysctl.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
Makefile
mq_sysctl.c Mainly singleton patches, documented in their respective changelogs. 2024-05-19 14:02:03 -07:00
mqueue.c introduce fd_file(), convert all accessors to it. 2024-08-12 22:00:43 -04:00
msg.c ipc/msg.c: fix percpu_counter use after free 2022-10-28 13:37:22 -07:00
msgutil.c ipc, msg: Use dedicated slab buckets for alloc_msg() 2024-07-03 12:24:20 +02:00
namespace.c ipc: fix memleak if msg_init_ns failed in create_ipc_ns 2024-12-05 14:03:02 +01:00
sem.c ipc/sem: use flexible array in 'struct sem_undo' 2023-08-18 10:18:51 -07:00
shm.c ipc: fix to protect IPCS lookups using RCU 2025-06-27 11:11:22 +01:00
syscall.c y2038: remove CONFIG_64BIT_TIME 2019-11-15 14:38:27 +01:00
util.c ipc/util.c: cleanup and improve sysvipc_find_ipc() 2022-09-11 21:55:05 -07:00
util.h sched.h: move pid helpers to pid.h 2023-12-20 19:26:31 -05:00