Messages in this thread Patch in this message | | | Date | Thu, 16 Feb 2012 01:58:07 +0400 | From | Cyrill Gorcunov <> | Subject | Re: + syscalls-x86-add-__nr_kcmp-syscall-v8.patch added to -mm tree |
| |
On Thu, Feb 16, 2012 at 01:09:34AM +0400, Cyrill Gorcunov wrote: > On Thu, Feb 16, 2012 at 12:25:38AM +0400, Cyrill Gorcunov wrote: > > > > Something like below I think (not yet tested, overall update). > > > > OK, this one I've just tested. Please review, so I won't miss > something obvious (I'm fetching linux-next now, if the patch > is already there I'll cook one on top). > ---
Unfortunately I dont see this patch in linux-next, so I cooked it as interdiff'ed. Please review.
Maybe (if this patch is fine) we could drop v8 and I would squash this changed into v9 (together with update to self test)?
Cyrill From: Cyrill Gorcunov <gorcunov@openvz.org> Subject: syscalls, x86: Fix __NR_kcmp execve race and potential NULL dereference
Plain ptrace_may_access() check used in kcmp is not safe against race with execve(setuid_app), so we need to grab cred_guard_mutex and keep it until kcmp is finished.
Also task->files may be nil, better to use task_lock and fcheck_files helpers instead of direct file_lock usage.
Reported-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> --- diff -u linux-2.6.git/kernel/kcmp.c linux-2.6.git/kernel/kcmp.c --- linux-2.6.git/kernel/kcmp.c +++ linux-2.6.git/kernel/kcmp.c @@ -44,20 +44,38 @@ static struct file * get_file_raw_ptr(struct task_struct *task, unsigned int idx) { - struct fdtable *fdt; - struct file *file; + struct file *file = NULL; - spin_lock(&task->files->file_lock); - fdt = files_fdtable(task->files); - if (idx < fdt->max_fds) - file = fdt->fd[idx]; - else - file = NULL; - spin_unlock(&task->files->file_lock); + task_lock(task); + rcu_read_lock(); + + if (task->files) + file = fcheck_files(task->files, idx); + + rcu_read_unlock(); + task_unlock(task); return file; } +static void access_unlock(struct task_struct *task) +{ + mutex_unlock(&task->signal->cred_guard_mutex); +} + +static int access_trylock(struct task_struct *task) +{ + if (!mutex_trylock(&task->signal->cred_guard_mutex)) + return -EBUSY; + + if (!ptrace_may_access(task, PTRACE_MODE_READ)) { + mutex_unlock(&task->signal->cred_guard_mutex); + return -EPERM; + } + + return 0; +} + SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, unsigned long, idx1, unsigned long, idx2) { @@ -82,11 +100,12 @@ /* * One should have enough rights to inspect task details. */ - if (!ptrace_may_access(task1, PTRACE_MODE_READ) || - !ptrace_may_access(task2, PTRACE_MODE_READ)) { - ret = -EACCES; + ret = access_trylock(task1); + if (ret) goto err; - } + ret = access_trylock(task2); + if (ret) + goto err_unlock; switch (type) { case KCMP_FILE: { @@ -130,6 +149,9 @@ break; } + access_unlock(task2); +err_unlock: + access_unlock(task1); err: put_task_struct(task1); put_task_struct(task2); | |