| From 669deb9ce1a92804c1e54cf038a2e420ed335b6c Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 13 May 2020 17:50:48 -0700 |
| Subject: ipc/util.c: sysvipc_find_ipc() incorrectly updates position index |
| |
| From: Vasily Averin <vvs@virtuozzo.com> |
| |
| [ Upstream commit 5e698222c70257d13ae0816720dde57c56f81e15 ] |
| |
| Commit 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase |
| position index") is causing this bug (seen on 5.6.8): |
| |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| |
| # ipcmk -Q |
| Message queue id: 0 |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| 0x82db8127 0 root 644 0 0 |
| |
| # ipcmk -Q |
| Message queue id: 1 |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| 0x82db8127 0 root 644 0 0 |
| 0x76d1fb2a 1 root 644 0 0 |
| |
| # ipcrm -q 0 |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| 0x76d1fb2a 1 root 644 0 0 |
| 0x76d1fb2a 1 root 644 0 0 |
| |
| # ipcmk -Q |
| Message queue id: 2 |
| # ipcrm -q 2 |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| 0x76d1fb2a 1 root 644 0 0 |
| 0x76d1fb2a 1 root 644 0 0 |
| |
| # ipcmk -Q |
| Message queue id: 3 |
| # ipcrm -q 1 |
| # ipcs -q |
| |
| ------ Message Queues -------- |
| key msqid owner perms used-bytes messages |
| 0x7c982867 3 root 644 0 0 |
| 0x7c982867 3 root 644 0 0 |
| 0x7c982867 3 root 644 0 0 |
| 0x7c982867 3 root 644 0 0 |
| |
| Whenever an IPC item with a low id is deleted, the items with higher ids |
| are duplicated, as if filling a hole. |
| |
| new_pos should jump through hole of unused ids, pos can be updated |
| inside "for" cycle. |
| |
| Fixes: 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase position index") |
| Reported-by: Andreas Schwab <schwab@suse.de> |
| Reported-by: Randy Dunlap <rdunlap@infradead.org> |
| Signed-off-by: Vasily Averin <vvs@virtuozzo.com> |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Acked-by: Waiman Long <longman@redhat.com> |
| Cc: NeilBrown <neilb@suse.com> |
| Cc: Steven Rostedt <rostedt@goodmis.org> |
| Cc: Ingo Molnar <mingo@redhat.com> |
| Cc: Peter Oberparleiter <oberpar@linux.ibm.com> |
| Cc: Davidlohr Bueso <dave@stgolabs.net> |
| Cc: Manfred Spraul <manfred@colorfullife.com> |
| Cc: <stable@vger.kernel.org> |
| Link: http://lkml.kernel.org/r/4921fe9b-9385-a2b4-1dc4-1099be6d2e39@virtuozzo.com |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| ipc/util.c | 12 ++++++------ |
| 1 file changed, 6 insertions(+), 6 deletions(-) |
| |
| diff --git a/ipc/util.c b/ipc/util.c |
| index 2d70f25f64b83..c4a67982ec008 100644 |
| --- a/ipc/util.c |
| +++ b/ipc/util.c |
| @@ -764,21 +764,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, |
| total++; |
| } |
| |
| - *new_pos = pos + 1; |
| + ipc = NULL; |
| if (total >= ids->in_use) |
| - return NULL; |
| + goto out; |
| |
| for (; pos < ipc_mni; pos++) { |
| ipc = idr_find(&ids->ipcs_idr, pos); |
| if (ipc != NULL) { |
| rcu_read_lock(); |
| ipc_lock_object(ipc); |
| - return ipc; |
| + break; |
| } |
| } |
| - |
| - /* Out of range - return NULL to terminate iteration */ |
| - return NULL; |
| +out: |
| + *new_pos = pos + 1; |
| + return ipc; |
| } |
| |
| static void *sysvipc_proc_next(struct seq_file *s, void *it, loff_t *pos) |
| -- |
| 2.20.1 |
| |