linux-stable.git/ipc/msg.c, branch linux-3.16.y

ipc/msg: Fix msgctl(..., IPC_STAT, ...) between pid namespaces

2018-10-21T07:45:03+00:00

commit 39a4940eaa185910bb802ca9829c12268fd2c855 upstream.

Today msg_lspid and msg_lrpid are remembered in the pid namespace of
the creator and the processes that last send or received a sysvipc
message.  If you have processes in multiple pid namespaces that is
just wrong.  The process ids reported will not make the least bit of
sense.

This fix is slightly more susceptible to a performance problem than
the related fix for System V shared memory.  By definition the pids
are updated by msgsnd and msgrcv, the fast path of System V message
queues.  The only concern over the previous implementation is the
incrementing and decrementing of the pid reference count.  As that is
the only difference and multiple updates by of the task_tgid by
threads in the same process have been shown in af_unix sockets to
create a cache line ping-pong between cpus of the same processor.

In this case I don't expect cache lines holding pid reference counts
to ping pong between cpus.  As senders and receivers update different
pids there is a natural separation there.  Further if multiple threads
of the same process either send or receive messages the pid will be
updated to the same value and ipc_update_pid will avoid the reference
count update.

Which means in the common case I expect msg_lspid and msg_lrpid to
remain constant, and reference counts not to be updated when messages
are sent.

In rare cases it may be possible to trigger the issue which was
observed for af_unix sockets, but it will require multiple processes
with multiple threads to be either sending or receiving messages.  It
just does not feel likely that anyone would do that in practice.

This change updates msgctl(..., IPC_STAT, ...) to return msg_lspid and
msg_lrpid in the pid namespace of the process calling stat.

This change also updates cat /proc/sysvipc/msg to return print msg_lspid
and msg_lrpid in the pid namespace of the process that opened the proc
file.

Fixes: b488893a390e ("pid namespaces: changes to show virtual ids to user")
Reviewed-by: Nagarathnam Muthusamy 
Signed-off-by: "Eric W. Biederman" 
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings

ipc: remove use of seq_printf return value

2017-02-23T03:54:11+00:00

commit 7f032d6ef6154868a2a5d5f6b2c3f8587292196c upstream.

The seq_printf return value, because it's frequently misused,
will eventually be converted to void.

See: commit 1f33c41c03da ("seq_file: Rename seq_overflow() to
     seq_has_overflowed() and make public")

Signed-off-by: Joe Perches 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings

sysv, ipc: fix security-layer leaking

2016-11-20T01:17:04+00:00

commit 9b24fef9f0410fb5364245d6cc2bd044cc064007 upstream.

Commit 53dad6d3a8e5 ("ipc: fix race with LSMs") updated ipc_rcu_putref()
to receive rcu freeing function but used generic ipc_rcu_free() instead
of msg_rcu_free() which does security cleaning.

Running LTP msgsnd06 with kmemleak gives the following:

  cat /sys/kernel/debug/kmemleak

  unreferenced object 0xffff88003c0a11f8 (size 8):
    comm "msgsnd06", pid 1645, jiffies 4294672526 (age 6.549s)
    hex dump (first 8 bytes):
      1b 00 00 00 01 00 00 00                          ........
    backtrace:
      kmemleak_alloc+0x23/0x40
      kmem_cache_alloc_trace+0xe1/0x180
      selinux_msg_queue_alloc_security+0x3f/0xd0
      security_msg_queue_alloc+0x2e/0x40
      newque+0x4e/0x150
      ipcget+0x159/0x1b0
      SyS_msgget+0x39/0x40
      entry_SYSCALL_64_fastpath+0x13/0x8f

Manfred Spraul suggested to fix sem.c as well and Davidlohr Bueso to
only use ipc_rcu_free in case of security allocation failure in newary()

Fixes: 53dad6d3a8e ("ipc: fix race with LSMs")
Link: http://lkml.kernel.org/r/1470083552-22966-1-git-send-email-fabf@skynet.be
Signed-off-by: Fabian Frederick 
Cc: Davidlohr Bueso 
Cc: Manfred Spraul 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds 
Signed-off-by: Ben Hutchings

Initialize msg/shm IPC objects before doing ipc_addid()

2015-10-28T10:33:06+00:00

commit b9a532277938798b53178d5a66af6e2915cb27cf upstream.

As reported by Dmitry Vyukov, we really shouldn't do ipc_addid() before
having initialized the IPC object state.  Yes, we initialize the IPC
object in a locked state, but with all the lockless RCU lookup work,
that IPC object lock no longer means that the state cannot be seen.

We already did this for the IPC semaphore code (see commit e8577d1f0329:
"ipc/sem.c: fully initialize sem_array before making it visible") but we
clearly forgot about msg and shm.

Reported-by: Dmitry Vyukov 
Cc: Manfred Spraul 
Cc: Davidlohr Bueso 
Signed-off-by: Linus Torvalds 
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques

ipc,msg: document volatile r_msg

2014-06-06T23:08:15+00:00

The need for volatile is not obvious, document it.

Signed-off-by: Davidlohr Bueso 
Signed-off-by: Manfred Spraul 
Cc: Aswin Chandramouleeswaran 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc,msg: move some msgq ns code around

2014-06-06T23:08:14+00:00

Nothing big and no logical changes, just get rid of some redundant
function declarations.  Move msg_[init/exit]_ns down the end of the
file.

Signed-off-by: Davidlohr Bueso 
Signed-off-by: Manfred Spraul 
Cc: Aswin Chandramouleeswaran 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc,msg: use current->state helpers

2014-06-06T23:08:14+00:00

Call __set_current_state() instead of assigning the new state directly.

Signed-off-by: Davidlohr Bueso 
Signed-off-by: Manfred Spraul 
Cc: Aswin Chandramouleeswaran 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc, kernel: clear whitespace

2014-06-06T23:08:14+00:00

trailing whitespace

Signed-off-by: Paul McQuade 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc, kernel: use Linux headers

2014-06-06T23:08:14+00:00

Use #include  instead of 
Use #include  instead of 

Signed-off-by: Paul McQuade 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

ipc: constify ipc_ops

2014-06-06T23:08:14+00:00

There is no need to recreate the very same ipc_ops structure on every
kernel entry for msgget/semget/shmget.  Just declare it static and be
done with it.  While at it, constify it as we don't modify the structure
at runtime.

Found in the PaX patch, written by the PaX Team.

Signed-off-by: Mathias Krause 
Cc: PaX Team 
Cc: Davidlohr Bueso 
Cc: Manfred Spraul 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds