CVE-2021-47069

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry<br /> <br /> do_mq_timedreceive calls wq_sleep with a stack local address. The<br /> sender (do_mq_timedsend) uses this address to later call pipelined_send.<br /> <br /> This leads to a very hard to trigger race where a do_mq_timedreceive<br /> call might return and leave do_mq_timedsend to rely on an invalid<br /> address, causing the following crash:<br /> <br /> RIP: 0010:wake_q_add_safe+0x13/0x60<br /> Call Trace:<br /> __x64_sys_mq_timedsend+0x2a9/0x490<br /> do_syscall_64+0x80/0x680<br /> entry_SYSCALL_64_after_hwframe+0x44/0xa9<br /> RIP: 0033:0x7f5928e40343<br /> <br /> The race occurs as:<br /> <br /> 1. do_mq_timedreceive calls wq_sleep with the address of `struct<br /> ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it<br /> holds a valid `struct ext_wait_queue *` as long as the stack has not<br /> been overwritten.<br /> <br /> 2. `ewq_addr` gets added to info-&gt;e_wait_q[RECV].list in wq_add, and<br /> do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call<br /> __pipelined_op.<br /> <br /> 3. Sender calls __pipelined_op::smp_store_release(&amp;this-&gt;state,<br /> STATE_READY). Here is where the race window begins. (`this` is<br /> `ewq_addr`.)<br /> <br /> 4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it<br /> will see `state == STATE_READY` and break.<br /> <br /> 5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed<br /> to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive&amp;#39;s<br /> stack. (Although the address may not get overwritten until another<br /> function happens to touch it, which means it can persist around for an<br /> indefinite time.)<br /> <br /> 6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a<br /> `struct ext_wait_queue *`, and uses it to find a task_struct to pass to<br /> the wake_q_add_safe call. In the lucky case where nothing has<br /> overwritten `ewq_addr` yet, `ewq_addr-&gt;task` is the right task_struct.<br /> In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a<br /> bogus address as the receiver&amp;#39;s task_struct causing the crash.<br /> <br /> do_mq_timedsend::__pipelined_op() should not dereference `this` after<br /> setting STATE_READY, as the receiver counterpart is now free to return.<br /> Change __pipelined_op to call wake_q_add_safe on the receiver&amp;#39;s<br /> task_struct returned by get_task_struct, instead of dereferencing `this`<br /> which sits on the receiver&amp;#39;s stack.<br /> <br /> As Manfred pointed out, the race potentially also exists in<br /> ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix<br /> those in the same way.