android_kernel_samsung_msm8976/ipc
Cong Wang 74afdeee1b mqueue: fix a use-after-free in sys_mq_notify()
commit f991af3daabaecff34684fd51fac80319d1baad1 upstream.

The retry logic for netlink_attachskb() inside sys_mq_notify()
is nasty and vulnerable:

1) The sock refcnt is already released when retry is needed
2) The fd is controllable by user-space because we already
   release the file refcnt

so we when retry but the fd has been just closed by user-space
during this small window, we end up calling netlink_detachskb()
on the error path which releases the sock again, later when
the user-space closes this socket a use-after-free could be
triggered.

Setting 'sock' to NULL here should be sufficient to fix it.

Change-Id: I2a2d5b9330a8b79cbe1303b7b8ca434c2824f0fe
Reported-by: GeneBlue <geneblue.mail@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Manfred Spraul <manfred@colorfullife.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
2018-05-26 00:39:34 +02:00
..
compat.c ipc: fix compat msgrcv with negative msgtyp 2015-04-19 10:10:50 +02:00
compat_mq.c
ipc_sysctl.c ipc: always handle a new value of auto_msgmni 2014-11-21 09:22:54 -08:00
ipcns_notifier.c
Makefile
mq_sysctl.c
mqueue.c mqueue: fix a use-after-free in sys_mq_notify() 2018-05-26 00:39:34 +02:00
msg.c Initialize msg/shm IPC objects before doing ipc_addid() 2016-05-18 14:32:58 +05:30
msgutil.c
namespace.c
sem.c Merge remote-tracking branch 'f2fs/linux-3.10.y' into HEAD 2017-04-18 17:02:28 +02:00
shm.c ipc/shm: Fix shmat mmap nil-page protection 2017-04-22 23:02:58 +02:00
syscall.c
util.c Initialize msg/shm IPC objects before doing ipc_addid() 2016-05-18 14:32:58 +05:30
util.h