Manfred Spraul e2652ae6bd ipc: reorganize initialization of kern_ipc_perm.seq ... ipc_addid() initializes kern_ipc_perm.seq after having called idr_alloc() (within ipc_idr_alloc()). Thus a parallel semop() or msgrcv() that uses ipc_obtain_object_check() may see an uninitialized value. The patch moves the initialization of kern_ipc_perm.seq before the calls of idr_alloc(). Notes: 1) This patch has a user space visible side effect: If /proc/sys/kernel/*_next_id is used (i.e.: checkpoint/restore) and if semget()/msgget()/shmget() fails in the final step of adding the id to the rhash tree, then .._next_id is cleared. Before the patch, is remained unmodified. There is no change of the behavior after a successful ..get() call: It always clears .._next_id, there is no impact to non checkpoint/restore code as that code does not use .._next_id. 2) The patch correctly documents that after a call to ipc_idr_alloc(), the full tear-down sequence must be used. The callers of ipc_addid() do not fullfill that, i.e. more bugfixes are required. The patch is a squash of a patch from Dmitry and my own changes. Link: http://lkml.kernel.org/r/20180712185241.4017-3-manfred@colorfullife.com Reported-by: syzbot+2827ef6b3385deb07eaf@syzkaller.appspotmail.com Signed-off-by: Manfred Spraul <manfred@colorfullife.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Kees Cook <keescook@chromium.org> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Michael Kerrisk <mtk.manpages@gmail.com> Cc: Davidlohr Bueso <dbueso@suse.de> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: Michal Hocko <mhocko@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2018-08-22 10:52:51 -07:00
..
ABI	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
EDID	…
PCI	Merge branch 'remotes/lorenzo/pci/dwc'	2018-08-15 14:59:11 -05:00
RCU	rculist: Improve documentation for list_for_each_entry_from_rcu()	2018-07-12 15:39:25 -07:00
accelerators	ocxl: Document new OCXL IOCTLs	2018-06-03 20:40:33 +10:00
accounting	…
acpi	ACPI: property: graph: Update graph documentation to use generic references	2018-07-23 12:44:52 +02:00
admin-guide	mm, oom: introduce memory.oom.group	2018-08-22 10:52:45 -07:00
aoe	…
arm	ARM: Device-tree updates	2018-06-11 17:57:38 -07:00
arm64	ARM:	2018-04-09 11:42:31 -07:00
auxdisplay	Doc: misc-devices: move lcd-panel-cgram.txt to auxdisplay/	2018-04-12 16:08:02 +02:00
backlight	…
block	block: Track DISCARD statistics and output them in stat and diskstat	2018-07-18 08:44:22 -06:00
blockdev	zram: introduce zram memory tracking	2018-06-07 17:34:34 -07:00
bpf	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2018-08-07 11:02:05 -07:00
bus-devices	…
cdrom	Documentation/cdrom: fix German sharp s in LaTex	2018-03-08 19:35:29 -07:00
cgroup-v1	page cache: use xa_lock	2018-04-11 10:28:39 -07:00
cma	…
connector	…
console	Documentation: corrections to console/console.txt	2018-08-10 16:09:40 -06:00
core-api	This was a moderately busy cycle for docs, with the usual collection of	2018-08-14 14:29:31 -07:00
cpu-freq	cpufreq: Drop cpufreq_table_validate_and_show()	2018-04-10 08:40:45 +02:00
cpuidle	cpuidle: Add definition of residency to sysfs documentation	2018-04-09 13:44:37 +02:00
crypto	crypto: remove redundant type flags from tfm allocation	2018-07-09 00:30:29 +08:00
dev-tools	doc: dev-tools: kselftest.rst: update contributing new tests	2018-06-29 09:01:50 -06:00
device-mapper	dm thin: include metadata_low_watermark threshold in pool status	2018-07-30 11:49:08 -04:00
devicetree	RTC for 4.19	2018-08-20 16:30:27 -07:00
doc-guide	Documentation/sphinx: allow "functions" with no parameters	2018-06-30 07:52:42 -06:00
driver-api	Driver core patches for 4.19-rc1	2018-08-18 11:44:53 -07:00
driver-model	dmaengine: add a new helper dmaenginem_async_device_register	2018-07-30 10:50:22 +05:30
early-userspace	…
extcon	…
fault-injection	Documentation: nvme: Documentation for nvme fault injection	2018-03-26 08:53:43 -06:00
fb	console/fbcon: Add support for deferred console takeover	2018-06-28 15:20:30 +02:00
features	ARM: 8777/1: Hook up SYNC_CORE functionality for sys_membarrier()	2018-07-11 11:02:08 +01:00
filesystems	/proc/meminfo: add percpu populated pages count	2018-08-22 10:52:45 -07:00
firmware_class	…
fmc	…
fpga	docs: fpga: add a document for FPGA Device Feature List (DFL) Framework Overview	2018-07-15 13:55:44 +02:00
gpio	Documentation: gpio: Move drivers-on-gpio.txt to driver-api	2018-03-23 04:22:29 +01:00
gpu	drm/msm/gpu: Add the buffer objects from the submit to the crash dump	2018-07-30 08:50:10 -04:00
hid	Documentation: fix input related doc refs	2017-10-12 11:14:06 -06:00
hwmon	powerpc updates for 4.19	2018-08-17 11:32:50 -07:00
i2c	Merge branch 'i2c/for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2018-06-14 16:21:46 +09:00
ia64	ia64: doc: tweak whitespace for 'console=' parameter	2018-03-05 14:41:38 -08:00
ide	…
iio	…
infiniband	Documentation/ABI: update infiniband sysfs interfaces	2018-02-23 08:18:33 -07:00
input	input: add MT_TOOL_DIAL	2018-07-17 15:33:47 +02:00
ioctl	Char/Misc driver patches for 4.19-rc1	2018-08-18 11:04:51 -07:00
isdn	Documentation/isdn: check and fix dead links ...	2018-03-26 12:31:13 -04:00
kbuild	Kconfig updates for v4.19	2018-08-15 12:50:10 -07:00
kdump	…
kernel-hacking	doc:it_IT: translation for kernel-hacking	2018-07-26 16:21:09 -06:00
laptops	platform/x86: thinkpad_acpi: silence HKEY 0x6032, 0x60f0, 0x6030	2018-05-07 15:10:31 +03:00
leds	Documentation: leds: Update 00-INDEX file	2017-10-23 20:17:03 +02:00
lightnvm	…
livepatch	livepatch: Remove not longer valid limitations from the documentation	2018-05-24 15:37:57 +02:00
locking	locking: Implement an algorithm choice for Wound-Wait mutexes	2018-07-03 09:44:36 +02:00
m68k	…
maintainer	docs: Fix more broken references	2018-06-15 18:11:26 -03:00
md	raid5-ppl: PPL support for disks with write-back cache enabled	2018-01-15 14:29:42 -08:00
media	media: doc: media/v4l-drivers: Update Qualcomm CAMSS driver document for 8x96	2018-08-02 08:48:00 -04:00
memory-devices	…
mic	…
mips	Documentation: mips: Update AU1xxx_IDE Kconfig dependencies	2018-02-01 12:45:35 -07:00
misc-devices	pci_endpoint_test: Add 2 ioctl commands	2018-07-19 11:46:57 +01:00
mmc	…
mtd	mtd: spi-nor: add an API to restore the status of SPI flash chip	2017-12-13 00:36:00 +01:00
namespaces	…
netlabel	…
networking	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-08-18 09:59:19 -07:00
nfc	…
nios2	…
nvdimm	…
nvmem	…
openrisc	Documentation: openrisc: Updates to README	2017-10-30 21:37:53 +09:00
parisc	…
pcmcia	pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function	2018-08-18 12:30:42 -07:00
perf	drivers/bus: Move Arm CCN PMU driver	2018-03-06 17:26:15 +01:00
phy	…
platform	…
power	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
powerpc	powerpc: Document issues with TM on POWER9	2018-07-02 23:54:29 +10:00
pps	…
process	Raise the minimum required gcc version to 4.6	2018-08-20 14:12:38 -07:00
pti	…
ptp	ptp: Fix documentation to match code.	2018-03-26 12:13:21 -04:00
rapidio	Documentation: rapidio: move sysfs interface to ABI	2018-02-23 08:25:45 -07:00
riscv	perf: riscv: Add Document for Future Porting Guide	2018-06-04 14:02:11 -07:00
s390	vfio-ccw: update documentation	2018-03-01 17:32:14 +01:00
scheduler	sched/deadline/Documentation: Add overrun signal and GRUB-PA documentation	2018-05-14 09:12:27 +02:00
scsi	block: remove BLK_EH_HANDLED	2018-05-29 08:59:21 -06:00
security	Kbuild: rename CC_STACKPROTECTOR[_STRONG] config variables	2018-06-14 12:21:18 +09:00
serial	…
sh	…
sound	ASoC: Updates for v4.19	2018-08-13 12:12:31 +02:00
sparc	sparc64: Add support for ADI (Application Data Integrity)	2018-03-18 07:38:48 -07:00
sphinx	Documentation/sphinx: allow "functions" with no parameters	2018-06-30 07:52:42 -06:00
sphinx-static	…
spi	…
sysctl	ipc: reorganize initialization of kern_ipc_perm.seq	2018-08-22 10:52:51 -07:00
target	…
thermal	thermal: Add cooling device's statistics in sysfs	2018-04-02 21:49:01 +08:00
timers	timekeeping.txt: Correct maxCount of n-bit binary counter	2018-07-23 09:33:06 -06:00
trace	This was a moderately busy cycle for docs, with the usual collection of	2018-08-14 14:29:31 -07:00
translations	This was a moderately busy cycle for docs, with the usual collection of	2018-08-14 14:29:31 -07:00
usb	USB-serial updates for v4.19-rc1	2018-07-20 21:47:15 +02:00
userspace-api	audit/stable-4.18 PR 20180605	2018-06-06 16:34:00 -07:00
virtual	KVM: X86: Implement "send IPI" hypercall	2018-08-06 17:59:20 +02:00
vm	docs/vm: move ksm and transhuge from "user" to "internals" section.	2018-05-29 06:45:55 -06:00
w1	w1: fix w1_ds2438 documentation	2018-07-07 17:27:13 +02:00
watchdog	watchdog: remove bfin_wdt driver	2018-03-26 15:57:04 +02:00
wimax	…
x86	Merge branch 'x86-timers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 18:28:19 -07:00
xtensa	xtensa: add support for KASAN	2017-12-16 22:37:12 -08:00
.gitignore	…
00-INDEX	docs: admin-guide: add cgroup-v2 documentation	2018-05-10 15:42:41 -06:00
Changes	…
CodingStyle	…
DMA-API-HOWTO.txt	…
DMA-API.txt	…
DMA-ISA-LPC.txt	…
DMA-attributes.txt	…
IPMI.txt	ipmi: Make IPMI panic strings always available	2017-09-27 16:03:45 -05:00
IRQ-affinity.txt	…
IRQ-domain.txt	irqdomain: Kill CONFIG_IRQ_DOMAIN_DEBUG	2018-01-24 12:32:58 +01:00
IRQ.txt	…
Intel-IOMMU.txt	…
Makefile	Documentation: add script and build target to check for broken file references	2017-10-12 11:07:42 -06:00
SAK.txt	…
SM501.txt	…
SubmittingPatches	…
atomic_bitops.txt	locking/atomic/bitops: Document and clarify ordering semantics for failed test_and_{}_bit()	2018-02-13 14:55:53 +01:00
atomic_t.txt	…
bt8xxgpio.txt	…
btmrvl.txt	…
bus-virt-phys-mapping.txt	…
clearing-warn-once.txt	kernel debug: support resetting WARN*_ONCE	2017-11-17 16:10:00 -08:00
conf.py	ext4: import inode data fork chapter from wiki page	2018-07-29 15:45:00 -04:00
cpu-load.txt	…
cputopology.txt	…
crc32.txt	…
dcdbas.txt	…
debugging-modules.txt	…
debugging-via-ohci1394.txt	…
dell_rbu.txt	Documentation: remove stale firmware API reference	2018-05-14 16:44:41 +02:00
digsig.txt	…
docutils.conf	…
dontdiff	…
efi-stub.txt	…
eisa.txt	…
flexible-arrays.txt	…
futex-requeue-pi.txt	…
gcc-plugins.txt	…
highuid.txt	…
hw_random.txt	…
hwspinlock.txt	…
index.rst	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2018-08-15 15:04:25 -07:00
intel_txt.txt	…
io-mapping.txt	…
io_ordering.txt	…
iostats.txt	block: Track DISCARD statistics and output them in stat and diskstat	2018-07-18 08:44:22 -06:00
irqflags-tracing.txt	…
isa.txt	…
isapnp.txt	…
kernel-per-CPU-kthreads.txt	…
kobject.txt	…
kprobes.txt	kprobes/Documentation: Fix various typos	2018-06-22 11:10:55 +02:00
kref.txt	…
ldm.txt	…
lockup-watchdogs.txt	…
logo.gif	…
logo.txt	…
lsm.txt	…
lzo.txt	…
mailbox.txt	…
memory-barriers.txt	sched/Documentation: Update wake_up() & co. memory-barrier guarantees	2018-07-17 09:30:34 +02:00
memory-hotplug.txt	…
men-chameleon-bus.txt	…
nommu-mmap.txt	Documentation: nommu-map: Fix duplicate word typo	2018-06-26 09:01:27 -06:00
ntb.txt	…
numastat.txt	…
padata.txt	…
parport-lowlevel.txt	…
percpu-rw-semaphore.txt	…
phy.txt	…
pi-futex.txt	Documentation: fix locking rt-mutex doc refs	2017-10-19 12:56:44 -06:00
pnp.txt	…
preempt-locking.txt	…
pwm.txt	…
rbtree.txt	…
remoteproc.txt	…
rfkill.txt	rfkill: Fix several typos in documentation	2018-06-15 13:36:08 +02:00
robust-futex-ABI.txt	…
robust-futexes.txt	…
rpmsg.txt	…
rtc.txt	Documentation: rtc: move iotcl interface documentation to ABI	2018-01-12 00:20:41 +01:00
sgi-ioc4.txt	…
siphash.txt	…
smsc_ece1099.txt	…
speculation.txt	Documentation: Document array_index_nospec	2018-01-30 21:54:28 +01:00
static-keys.txt	…
svga.txt	documentation/svga.txt: update outdated file	2017-11-20 10:45:50 -07:00
switchtec.txt	NTB: switchtec_ntb: Update switchtec documentation with notes for NTB	2017-11-18 20:37:13 -05:00
sync_file.txt	…
tee.txt	…
this_cpu_ops.txt	…
unaligned-memory-access.txt	…
vfio-mediated-device.txt	vfio/mdev: Check globally for duplicate devices	2018-06-08 10:24:27 -06:00
vfio.txt	vfio: fix documentation	2018-05-08 09:16:41 -06:00
video-output.txt	…
xillybus.txt	…
xz.txt	…
zorro.txt	…