diff options
| author | Kees Cook <keescook@chromium.org> | 2017-08-02 13:32:21 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-08-02 17:16:12 -0700 |
| commit | ade9f91b32b964e83d294f4973d50083b08ef6fc (patch) | |
| tree | bd40eaa291b03bb8a46188358cf9f4f74064de5c | |
| parent | 89affbf5d9ebb15c6460596822e8857ea2f9e735 (diff) | |
| download | linux-ade9f91b32b964e83d294f4973d50083b08ef6fc.tar.gz linux-ade9f91b32b964e83d294f4973d50083b08ef6fc.tar.bz2 linux-ade9f91b32b964e83d294f4973d50083b08ef6fc.zip | |
ipc: add missing container_of()s for randstruct
When building with the randstruct gcc plugin, the layout of the IPC
structs will be randomized, which requires any sub-structure accesses to
use container_of(). The proc display handlers were missing the needed
container_of()s since the iterator is passing in the top-level struct
kern_ipc_perm.
This would lead to crashes when running the "lsipc" program after the
system had IPC registered (e.g. after starting up Gnome):
general protection fault: 0000 [#1] PREEMPT SMP
...
RIP: 0010:shm_add_rss_swap.isra.1+0x13/0xa0
...
Call Trace:
sysvipc_shm_proc_show+0x5e/0x150
sysvipc_proc_show+0x1a/0x30
seq_read+0x2e9/0x3f0
...
Link: http://lkml.kernel.org/r/20170730205950.GA55841@beast
Fixes: 3859a271a003 ("randstruct: Mark various structs for randomization")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Dominik Brodowski <linux@dominikbrodowski.net>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | ipc/msg.c | 3 | ||||
| -rw-r--r-- | ipc/sem.c | 3 | ||||
| -rw-r--r-- | ipc/shm.c | 4 |
3 files changed, 7 insertions, 3 deletions
diff --git a/ipc/msg.c b/ipc/msg.c index 5b25e0755656..2c38f10d1483 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -1034,7 +1034,8 @@ void msg_exit_ns(struct ipc_namespace *ns) static int sysvipc_msg_proc_show(struct seq_file *s, void *it) { struct user_namespace *user_ns = seq_user_ns(s); - struct msg_queue *msq = it; + struct kern_ipc_perm *ipcp = it; + struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm); seq_printf(s, "%10d %10d %4o %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n", diff --git a/ipc/sem.c b/ipc/sem.c index 9e70cd7a17da..38371e93bfa5 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -2179,7 +2179,8 @@ void exit_sem(struct task_struct *tsk) static int sysvipc_sem_proc_show(struct seq_file *s, void *it) { struct user_namespace *user_ns = seq_user_ns(s); - struct sem_array *sma = it; + struct kern_ipc_perm *ipcp = it; + struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm); time_t sem_otime; /* diff --git a/ipc/shm.c b/ipc/shm.c index 28a444861a8f..8828b4c3a190 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1380,9 +1380,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr) static int sysvipc_shm_proc_show(struct seq_file *s, void *it) { struct user_namespace *user_ns = seq_user_ns(s); - struct shmid_kernel *shp = it; + struct kern_ipc_perm *ipcp = it; + struct shmid_kernel *shp; unsigned long rss = 0, swp = 0; + shp = container_of(ipcp, struct shmid_kernel, shm_perm); shm_add_rss_swap(shp, &rss, &swp); #if BITS_PER_LONG <= 32 |