Skip to content

GitLab

Switch branch/tag
History Find file
Clone
ipc/mqueue.c: only perform resource calculation if user valid
Kees Cook authored 
[ Upstream commit a318f12e ]

Andreas Christoforou reported:

  UBSAN: Undefined behaviour in ipc/mqueue.c:414:49 signed integer overflow:
  9 * 2305843009213693951 cannot be represented in type 'long int'
  ...
  Call Trace:
    mqueue_evict_inode+0x8e7/0xa10 ipc/mqueue.c:414
    evict+0x472/0x8c0 fs/inode.c:558
    iput_final fs/inode.c:1547 [inline]
    iput+0x51d/0x8c0 fs/inode.c:1573
    mqueue_get_inode+0x8eb/0x1070 ipc/mqueue.c:320
    mqueue_create_attr+0x198/0x440 ipc/mqueue.c:459
    vfs_mkobj+0x39e/0x580 fs/namei.c:2892
    prepare_open ipc/mqueue.c:731 [inline]
    do_mq_open+0x6da/0x8e0 ipc/mqueue.c:771

Which could be triggered by:

        struct mq_attr attr = {
                .mq_flags = 0,
                .mq_maxmsg = 9,
                .mq_msgsize = 0x1fffffffffffffff,
                .mq_curmsgs = 0,
        };

        if (mq_open("/testing", 0x40, 3, &attr) == (mqd_t) -1)
                pe...
8e993f71
Name Last commit Last update
..
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license
compat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
ipc_sysctl.c ipc/msg: increase MSGMNI, remove scaling
mq_sysctl.c ipc: convert use of typedef ctl_table to struct ctl_table
mqueue.c ipc/mqueue.c: only perform resource calculation if user valid
msg.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
msgutil.c ipc: prevent lockup on alloc_msg and free_msg
namespace.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
sem.c ipc/sem.c: prevent queue.status tearing in semop
shm.c ipc/shm: fix shmat() nil address after round-down when remapping
syscall.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
util.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license
util.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license