Re: [PATCH 01/12] ipc: reorganize initialization of kern_ipc_perm.id

[Davidlohr Bueso]

On Mon, 09 Jul 2018, Manfred Spraul wrote:

> ipc_addid() initializes kern_ipc_perm.id after having called
> ipc_idr_alloc().
>
> Thus a parallel semop() or msgrcv() that uses ipc_obtain_object_idr()
> may see an uninitialized value.
>
> The patch moves all accesses to kern_ipc_perm.id under the spin_lock().

Yeah this is a lot better than my kzalloc() idea. I was considering
completions to avoid these races with ->getnew(), but careful init beats
that idea for obvious reasons.

The only thing I would say is that the title should be more descriptive.
Unlike the next patch, this one isn't really reorganizing anything.
How about:

 ipc: compute kern_ipc_perm.id under the ipc lock for stat cmds

> The issues is related to the finding of
> syzbot+2827ef6b3385deb07eaf@xxxxxxxxxxxxxxxxxxxxxxxxx:
> syzbot found an issue with kern_ipc_perm.seq
>
> Signed-off-by: Manfred Spraul <manfred@xxxxxxxxxxxxxxxx>
> Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
> Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> Cc: Davidlohr Bueso <dave@xxxxxxxxxxxx>

Reviewed-by: Davidlohr Bueso <dbueso@xxxxxxx>