)]}'
{
  "commit": "7be77e20d59fc3dd3fdde31641e0bc821114d26b",
  "tree": "558507e6fe540d1deddb2dbce9b3a7cca855a57e",
  "parents": [
    "ad0b142772eb1f88f0e77cb63c38b0005e83c2bd"
  ],
  "author": {
    "name": "Pavel Emelianov",
    "email": "xemul@openvz.org",
    "time": "Tue Jul 31 00:38:48 2007 -0700"
  },
  "committer": {
    "name": "Linus Torvalds",
    "email": "torvalds@woody.linux-foundation.org",
    "time": "Tue Jul 31 15:39:40 2007 -0700"
  },
  "message": "Fix user struct leakage with locked IPC shem segment\n\nWhen user locks an ipc shmem segmant with SHM_LOCK ctl and the segment is\nalready locked the shmem_lock() function returns 0.  After this the\nsubsequent code leaks the existing user struct:\n\n\u003d\u003d ipc/shm.c: sys_shmctl() \u003d\u003d\n     ...\n     err \u003d shmem_lock(shp-\u003eshm_file, 1, user);\n     if (!err) {\n          shp-\u003eshm_perm.mode |\u003d SHM_LOCKED;\n          shp-\u003emlock_user \u003d user;\n     }\n     ...\n\u003d\u003d\n\nOther results of this are:\n1. the new shp-\u003emlock_user is not get-ed and will point to freed\n   memory when the task dies.\n2. the RLIMIT_MEMLOCK is screwed on both user structs.\n\nThe exploit looks like this:\n\n\u003d\u003d\n    id \u003d shmget(...);\n    setresuid(uid, 0, 0);\n    shmctl(id, SHM_LOCK, NULL);\n    setresuid(uid + 1, 0, 0);\n    shmctl(id, SHM_LOCK, NULL);\n\u003d\u003d\n\nMy solution is to return 0 to the userspace and do not change the\nsegment\u0027s user.\n\nSigned-off-by: Pavel Emelianov \u003cxemul@openvz.org\u003e\nCc: \u003cstable@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d88ac5a07ec72464266227856238964595303825",
      "old_mode": 33188,
      "old_path": "ipc/shm.c",
      "new_id": "a86a3a5c8a19589698dc8b9ec555e1d98891466d",
      "new_mode": 33188,
      "new_path": "ipc/shm.c"
    }
  ]
}