• S
    ipc: sysvsem: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC) · 02fdb36a
    Serge E. Hallyn 提交于
    CLONE_NEWIPC|CLONE_SYSVSEM interaction isn't handled properly.  This can cause
    a kernel memory corruption.  CLONE_NEWIPC must detach from the existing undo
    lists.
    
    Fix, part 3: refuse clone(CLONE_SYSVSEM|CLONE_NEWIPC).
    
    With unshare, specifying CLONE_SYSVSEM means unshare the sysvsem.  So it seems
    reasonable that CLONE_NEWIPC without CLONE_SYSVSEM would just imply
    CLONE_SYSVSEM.
    
    However with clone, specifying CLONE_SYSVSEM means *share* the sysvsem.  So
    calling clone(CLONE_SYSVSEM|CLONE_NEWIPC) is explicitly asking for something
    we can't allow.  So return -EINVAL in that case.
    
    [akpm@linux-foundation.org: cleanups]
    Signed-off-by: NSerge E. Hallyn <serue@us.ibm.com>
    Cc: Manfred Spraul <manfred@colorfullife.com>
    Acked-by: N"Eric W. Biederman" <ebiederm@xmission.com>
    Cc: Pavel Emelyanov <xemul@openvz.org>
    Cc: Michael Kerrisk <mtk.manpages@googlemail.com>
    Cc: Pierre Peiffer <peifferp@gmail.com>
    Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
    02fdb36a
nsproxy.c 5.5 KB