oss-security - CVE request: kernel: shm: fix shmctl(SHM_INFO) lockup with !CONFIG

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 6 Mar 2009 16:27:39 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: shm: fix shmctl(SHM_INFO) lockup with 
	!CONFIG_SHMEM

According to the upstream commit
a68e61e8ff2d46327a37b69056998b47745db6fa, shm_get_stat() assumes that
the inode is a "struct shmem_inode_info", which is incorrect for
!CONFIG_SHMEM (see fs/ramfs/inode.c: ramfs_get_inode() vs.
mm/shmem.c: shmem_get_inode()).

This bad assumption can cause shmctl(SHM_INFO) to lockup when
shm_get_stat() tries to spin_lock(&info->lock).  Users of
!CONFIG_SHMEM may encounter this lockup simply by invoking the 'ipcs'
command.

Reported by Jiri Olsa back in February 2008:
http://lkml.org/lkml/2008/2/29/74

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.