[PATCH 1/3] ipc: sysvsem: implement sys_unshare(CLONE_SYSVSEM)

[PATCH 1/3] ipc: sysvsem: implement sys_unshare(CLONE_SYSVSEM)

[Serge E. Hallyn]

(patches 1 and 2 were originally by Manfred Spraul)

sys_unshare(CLONE_NEWIPC) doesn't handle the undo lists properly, this can
cause a kernel memory corruption. CLONE_NEWIPC must detach from the existing
undo lists.

Fix, part 1: add support for sys_unshare(CLONE_SYSVSEM)

The original reason to not support it was the potential (inevitable?)
confusion due to the fact that sys_unshare(CLONE_SYSVSEM) has the
inverse meaning of clone(CLONE_SYSVSEM).

Our two most reasonable options then appear to be (1) fully support
CLONE_SYSVSEM, or (2) continue to refuse explicit CLONE_SYSVSEM,
but always do it anyway on unshare(CLONE_SYSVSEM).  This patch does
(1).

Changelog:
	Apr 16: SEH: switch to Manfred's alternative patch which
		removes the unshare_semundo() function which
		always refused CLONE_SYSVSEM.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
 ipc/sem.c     |    1 +
 kernel/fork.c |   29 +++++++++++------------------
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/ipc/sem.c b/ipc/sem.c
index d56d3ab..e9418df 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1250,6 +1250,7 @@ void exit_sem(struct task_struct *tsk)
 	undo_list = tsk->sysvsem.undo_list;
 	if (!undo_list)
 		return;
+	tsk->sysvsem.undo_list = NULL;
 
 	if (!atomic_dec_and_test(&undo_list->refcnt))
 		return;
diff --git a/kernel/fork.c b/kernel/fork.c
index addab87..56fa5ae 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1678,18 +1678,6 @@ static int unshare_fd(unsigned long unshare_flags, struct files_struct **new_fdp
 }
 
 /*
- * Unsharing of semundo for tasks created with CLONE_SYSVSEM is not
- * supported yet
- */
-static int unshare_semundo(unsigned long unshare_flags, struct sem_undo_list **new_ulistp)
-{
-	if (unshare_flags & CLONE_SYSVSEM)
-		return -EINVAL;
-
-	return 0;
-}
-
-/*
  * unshare allows a process to 'unshare' part of the process
  * context which was originally shared using clone.  copy_*
  * functions used by do_fork() cannot be used here directly
@@ -1704,8 +1692,8 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 	struct sighand_struct *new_sigh = NULL;
 	struct mm_struct *mm, *new_mm = NULL, *active_mm = NULL;
 	struct files_struct *fd, *new_fd = NULL;
-	struct sem_undo_list *new_ulist = NULL;
 	struct nsproxy *new_nsproxy = NULL;
+	int do_sysvsem = 0;
 
 	check_unshare_flags(&unshare_flags);
 
@@ -1717,6 +1705,8 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 				CLONE_NEWNET))
 		goto bad_unshare_out;
 
+	if (unshare_flags & CLONE_SYSVSEM)
+		do_sysvsem = 1;
 	if ((err = unshare_thread(unshare_flags)))
 		goto bad_unshare_out;
 	if ((err = unshare_fs(unshare_flags, &new_fs)))
@@ -1727,13 +1717,17 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 		goto bad_unshare_cleanup_sigh;
 	if ((err = unshare_fd(unshare_flags, &new_fd)))
 		goto bad_unshare_cleanup_vm;
-	if ((err = unshare_semundo(unshare_flags, &new_ulist)))
-		goto bad_unshare_cleanup_fd;
 	if ((err = unshare_nsproxy_namespaces(unshare_flags, &new_nsproxy,
 			new_fs)))
-		goto bad_unshare_cleanup_semundo;
+		goto bad_unshare_cleanup_fd;
 
-	if (new_fs ||  new_mm || new_fd || new_ulist || new_nsproxy) {
+	if (new_fs ||  new_mm || new_fd || do_sysvsem || new_nsproxy) {
+		if (do_sysvsem) {
+			/*
+			 * CLONE_SYSVSEM is equivalent to sys_exit().
+			 */
+			exit_sem(current);
+		}
 
 		if (new_nsproxy) {
 			switch_task_namespaces(current, new_nsproxy);
@@ -1769,7 +1763,6 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 	if (new_nsproxy)
 		put_nsproxy(new_nsproxy);
 
-bad_unshare_cleanup_semundo:
 bad_unshare_cleanup_fd:
 	if (new_fd)
 		put_files_struct(new_fd);
-- 
1.5.1.1.GIT

[PATCH 2/3] ipc: sysvsem: force unshare(CLONE_SYSVSEM) when CLONE_NEWIPC

[Serge E. Hallyn]

sys_unshare(CLONE_NEWIPC) doesn't handle the undo lists properly, this can
cause a kernel memory corruption. CLONE_NEWIPC must detach from the existing
undo lists.
Fix, part 2: perform an implicit CLONE_SYSVSEM in CLONE_NEWIPC.
CLONE_NEWIPC creates a new IPC namespace, the task cannot access the
existing semaphore arrays after the unshare syscall. Thus the task
can/must detach from the existing undo list entries, too.

This fixes the kernel corruption, because it makes it impossible that
undo records from two different namespaces are in sysvsem.undo_list.

Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
 kernel/fork.c |    7 ++++++-
 1 files changed, 6 insertions(+), 1 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index 56fa5ae..4c28232 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1705,7 +1705,12 @@ asmlinkage long sys_unshare(unsigned long unshare_flags)
 				CLONE_NEWNET))
 		goto bad_unshare_out;
 
-	if (unshare_flags & CLONE_SYSVSEM)
+	/*
+	 * CLONE_NEWIPC must also detach from the undolist: after switching
+	 * to a new ipc namespace, the semaphore arrays from the old
+	 * namespace are unreachable.
+	 */
+	if (unshare_flags & (CLONE_NEWIPC|CLONE_SYSVSEM))
 		do_sysvsem = 1;
 	if ((err = unshare_thread(unshare_flags)))
 		goto bad_unshare_out;
-- 
1.5.1.1.GIT

[PATCH 3/3] ipc: sysvsem: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC)

[Serge E. Hallyn]

CLONE_NEWIPC|CLONE_SYSVSEM interaction isn't handled properly.  This can
cause a kernel memory corruption. CLONE_NEWIPC must detach from the existing
undo lists.
Fix, part 3: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC).

With unshare, specifying CLONE_SYSVSEM means unshare the sysvsem.  So
it seems reasonable that CLONE_NEWIPC without CLONE_SYSVSEM would just
imply CLONE_SYSVSEM.

However with clone, specifying CLONE_SYSVSEM means *share* the sysvsem.
So calling clone(CLONE_SYSVSEM|CLONE_NEWIPC) is explicitly asking for
something we can't allow.  So return -EINVAL in that case.

Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
---
 kernel/nsproxy.c |   12 ++++++++++++
 1 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index f5d332c..468ade3 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -139,6 +139,18 @@ int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 		goto out;
 	}
 
+	/*
+	 * CLONE_NEWIPC must detach from the undolist: after switching
+	 * to a new ipc namespace, the semaphore arrays from the old
+	 * namespace are unreachable.  In clone parlance, CLONE_SYSVSEM
+	 * means share undolist with parent, so we must forbid using
+	 * it along with CLONE_NEWIPC.
+	 */
+	if ((flags&CLONE_NEWIPC) && (flags&CLONE_SYSVSEM)) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	new_ns = create_new_namespaces(flags, tsk, tsk->fs);
 	if (IS_ERR(new_ns)) {
 		err = PTR_ERR(new_ns);
-- 
1.5.1.1.GIT

Re: [PATCH 1/3] ipc: sysvsem: implement sys_unshare(CLONE_SYSVSEM)

[Eric W. Biederman]

"Serge E. Hallyn" <serue@us.ibm.com> writes:

> (patches 1 and 2 were originally by Manfred Spraul)
>
> sys_unshare(CLONE_NEWIPC) doesn't handle the undo lists properly, this can
> cause a kernel memory corruption. CLONE_NEWIPC must detach from the existing
> undo lists.
>
> Fix, part 1: add support for sys_unshare(CLONE_SYSVSEM)
>
> The original reason to not support it was the potential (inevitable?)
> confusion due to the fact that sys_unshare(CLONE_SYSVSEM) has the
> inverse meaning of clone(CLONE_SYSVSEM).
>
> Our two most reasonable options then appear to be (1) fully support
> CLONE_SYSVSEM, or (2) continue to refuse explicit CLONE_SYSVSEM,
> but always do it anyway on unshare(CLONE_SYSVSEM).  This patch does
> (1).
>
> Changelog:
> 	Apr 16: SEH: switch to Manfred's alternative patch which
> 		removes the unshare_semundo() function which
> 		always refused CLONE_SYSVSEM.
>
> Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
> Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>

These patches look like the fix the core issue.

Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>

Eric

Re: [PATCH 1/3] ipc: sysvsem: implement sys_unshare(CLONE_SYSVSEM)

[Andrew Morton]

On Wed, 16 Apr 2008 11:42:32 -0500
"Serge E. Hallyn" <serue@us.ibm.com> wrote:

> (patches 1 and 2 were originally by Manfred Spraul)

The way we handle this is to put a From: line right at the start of the
changelog.

I've assumed that this is what you intended, and have made that change. 
But maybe you didn't intend to do this - perhaps the patches are
sufficiently different from Manfred's originals that this wasn't
appropriate?  It's appropriate for #2, maybe not #1.  I'll let you two
fight it out ;)