ipc: add missing container_of()s for randstruct

When building with the randstruct gcc plugin, the layout of the IPC
structs will be randomized, which requires any sub-structure accesses to
use container_of().  The proc display handlers were missing the needed
container_of()s since the iterator is passing in the top-level struct
kern_ipc_perm.

This would lead to crashes when running the "lsipc" program after the
system had IPC registered (e.g. after starting up Gnome):

  general protection fault: 0000 [#1] PREEMPT SMP
  ...
  RIP: 0010:shm_add_rss_swap.isra.1+0x13/0xa0
  ...
  Call Trace:
    sysvipc_shm_proc_show+0x5e/0x150
    sysvipc_proc_show+0x1a/0x30
    seq_read+0x2e9/0x3f0
  ...

Link: http://lkml.kernel.org/r/20170730205950.GA55841@beast
Fixes: 3859a271a003 ("randstruct: Mark various structs for randomization")
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Dominik Brodowski <linux@dominikbrodowski.net>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/ipc/msg.c b/ipc/msg.c
index 5b25e0755656a6a2b85a7f647bf77cd87db77a5a..2c38f10d148305857a6388764b0ad1501f227bce 100644 (file)
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -1034,7 +1034,8 @@ void msg_exit_ns(struct ipc_namespace *ns)
 static int sysvipc_msg_proc_show(struct seq_file *s, void *it)
 {
        struct user_namespace *user_ns = seq_user_ns(s);
-       struct msg_queue *msq = it;
+       struct kern_ipc_perm *ipcp = it;
+       struct msg_queue *msq = container_of(ipcp, struct msg_queue, q_perm);
 
        seq_printf(s,
                   "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",

diff --git a/ipc/sem.c b/ipc/sem.c
index 9e70cd7a17da7e74e915ce7f4061aa99aea66b89..38371e93bfa5c4f101e264b46eab6a19f2f02404 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -2179,7 +2179,8 @@ void exit_sem(struct task_struct *tsk)
 static int sysvipc_sem_proc_show(struct seq_file *s, void *it)
 {
        struct user_namespace *user_ns = seq_user_ns(s);
-       struct sem_array *sma = it;
+       struct kern_ipc_perm *ipcp = it;
+       struct sem_array *sma = container_of(ipcp, struct sem_array, sem_perm);
        time_t sem_otime;
 
        /*

diff --git a/ipc/shm.c b/ipc/shm.c
index 28a444861a8f489fa46edca81878eedf0f55da7a..8828b4c3a19041833f390d62f38084de2f64470b 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1380,9 +1380,11 @@ SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it)
 {
        struct user_namespace *user_ns = seq_user_ns(s);
-       struct shmid_kernel *shp = it;
+       struct kern_ipc_perm *ipcp = it;
+       struct shmid_kernel *shp;
        unsigned long rss = 0, swp = 0;
 
+       shp = container_of(ipcp, struct shmid_kernel, shm_perm);
        shm_add_rss_swap(shp, &rss, &swp);
 
 #if BITS_PER_LONG <= 32