Messages in this thread | | | Subject | Re: [PATCH] fs: Pass AT_GETATTR_NOSEC flag to getattr interface function | From | Mimi Zohar <> | Date | Mon, 09 Oct 2023 21:14:02 -0400 |
| |
On Tue, 2023-10-03 at 15:38 +0200, Christian Brauner wrote: > On Mon, Oct 02, 2023 at 04:22:25PM +0300, Amir Goldstein wrote: > > On Mon, Oct 2, 2023 at 3:57 PM Stefan Berger <stefanb@linux.vnet.ibm.com> wrote: > > > > > > From: Stefan Berger <stefanb@linux.ibm.com> > > > > > > When vfs_getattr_nosec() calls a filesystem's getattr interface function > > > then the 'nosec' should propagate into this function so that > > > vfs_getattr_nosec() can again be called from the filesystem's gettattr > > > rather than vfs_getattr(). The latter would add unnecessary security > > > checks that the initial vfs_getattr_nosec() call wanted to avoid. > > > Therefore, introduce the getattr flag GETATTR_NOSEC and allow to pass > > > with the new getattr_flags parameter to the getattr interface function. > > > In overlayfs and ecryptfs use this flag to determine which one of the > > > two functions to call. > > > > > > In a recent code change introduced to IMA vfs_getattr_nosec() ended up > > > calling vfs_getattr() in overlayfs, which in turn called > > > security_inode_getattr() on an exiting process that did not have > > > current->fs set anymore, which then caused a kernel NULL pointer > > > dereference. With this change the call to security_inode_getattr() can > > > be avoided, thus avoiding the NULL pointer dereference. > > > > > > Reported-by: syzbot+a67fc5321ffb4b311c98@syzkaller.appspotmail.com > > > Fixes: db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") > > > Cc: Alexander Viro <viro@zeniv.linux.org.uk> > > > Cc: linux-fsdevel@vger.kernel.org > > > Cc: Miklos Szeredi <miklos@szeredi.hu> > > > Cc: Amir Goldstein <amir73il@gmail.com> > > > Cc: Tyler Hicks <code@tyhicks.com> > > > Cc: Mimi Zohar <zohar@linux.ibm.com> > > > Suggested-by: Christian Brauner <brauner@kernel.org> > > > Co-developed-by: Amir Goldstein <amir73il@gmail.com> > > > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> > > > --- > > > > Reviewed-by: Amir Goldstein <amir73il@gmail.com> > > > > Now let's see what vfs maintainers think about this... > > Seems fine overall. We kind of need to propagate the knowledge through > the layers. But I don't like that we need something like it...
So at this point there are two options. Either revert commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version") or this patch to fix it. Christian, what do you prefer?
Mimi
| |