Alexander Mikhalitsyn 4378845398 shm: extend forced shm destroy to support objects from several IPC nses ... commit 85b6d24646 upstream. Currently, the exit_shm() function not designed to work properly when task->sysvshm.shm_clist holds shm objects from different IPC namespaces. This is a real pain when sysctl kernel.shm_rmid_forced = 1, because it leads to use-after-free (reproducer exists). This is an attempt to fix the problem by extending exit_shm mechanism to handle shm's destroy from several IPC ns'es. To achieve that we do several things: 1. add a namespace (non-refcounted) pointer to the struct shmid_kernel 2. during new shm object creation (newseg()/shmget syscall) we initialize this pointer by current task IPC ns 3. exit_shm() fully reworked such that it traverses over all shp's in task->sysvshm.shm_clist and gets IPC namespace not from current task as it was before but from shp's object itself, then call shm_destroy(shp, ns). Note: We need to be really careful here, because as it was said before (1), our pointer to IPC ns non-refcnt'ed. To be on the safe side we using special helper get_ipc_ns_not_zero() which allows to get IPC ns refcounter only if IPC ns not in the "state of destruction". Q/A Q: Why can we access shp->ns memory using non-refcounted pointer? A: Because shp object lifetime is always shorther than IPC namespace lifetime, so, if we get shp object from the task->sysvshm.shm_clist while holding task_lock(task) nobody can steal our namespace. Q: Does this patch change semantics of unshare/setns/clone syscalls? A: No. It's just fixes non-covered case when process may leave IPC namespace without getting task->sysvshm.shm_clist list cleaned up. Link: https://lkml.kernel.org/r/67bb03e5-f79c-1815-e2bf-949c67047418@colorfullife.com Link: https://lkml.kernel.org/r/20211109151501.4921-1-manfred@colorfullife.com Fixes: ab602f7991 ("shm: make exit_shm work proportional to task activity") Co-developed-by: Manfred Spraul <manfred@colorfullife.com> Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Signed-off-by: Alexander Mikhalitsyn <alexander.mikhalitsyn@virtuozzo.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Greg KH <gregkh@linuxfoundation.org> Cc: Andrei Vagin <avagin@gmail.com> Cc: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> Cc: Vasily Averin <vvs@virtuozzo.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-01 09:23:35 +01:00
..
compat.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ipc_sysctl.c	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
mq_sysctl.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
mqueue.c	ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()	2020-05-14 07:58:26 +02:00
msg.c	ipc/msg.c: consolidate all xxxctl_down() functions	2020-02-11 04:35:07 -08:00
msgutil.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 52	2019-05-24 17:36:42 +02:00
namespace.c	ipc: Convert mqueue fs to fs_context	2019-02-28 03:29:29 -05:00
sem.c	Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()"	2020-02-28 17:22:20 +01:00
shm.c	shm: extend forced shm destroy to support objects from several IPC nses	2021-12-01 09:23:35 +01:00
syscall.c	ipc: rename old-style shmctl/semctl/msgctl syscalls	2019-01-25 17:22:50 +01:00
util.c	ipc: WARN if trying to remove ipc object which is absent	2021-11-26 10:47:21 +01:00
util.h	ipc: fix sparc64 ipc() wrapper	2019-09-07 21:42:25 +02:00