From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752605AbaHWIug (ORCPT ); Sat, 23 Aug 2014 04:50:36 -0400 Received: from mail-lb0-f174.google.com ([209.85.217.174]:51545 "EHLO mail-lb0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752212AbaHWIuK (ORCPT ); Sat, 23 Aug 2014 04:50:10 -0400 Message-Id: <20140823085007.310194940@openvz.org> User-Agent: quilt/0.60-1 Date: Sat, 23 Aug 2014 12:46:12 +0400 From: Cyrill Gorcunov To: linux-kernel@vger.kernel.org Cc: akpm@linux-foundation.org, keescook@chromium.org, oleg@redhat.com, tj@kernel.org, avagin@openvz.org, ebiederm@xmission.com, hpa@zytor.com, serge.hallyn@canonical.com, xemul@parallels.com, segoon@openwall.com, kamezawa.hiroyu@jp.fujitsu.com, mtk.manpages@gmail.com, jln@google.com, Cyrill Gorcunov Subject: [patch 1/2 -mm] prctl: PR_SET_MM_MAP -- Copy @auxv from userspace early References: <20140823084611.939722362@openvz.org> Content-Disposition: inline; filename=prctl-rework-new-mm-map-auxv Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Oleg noticed that I'm doing a strange games with mm::mmap_sem member -- I take it and keep busy whie validating data which comes from user space but then I release it and copy auxv data itself. This means we've a small window where previously found VMAs might be no longer valid thus move @auxv validation and copying at the beginning of prctl_set_mm_map before we take the lock. Signed-off-by: Cyrill Gorcunov CC: Oleg Nesterov Cc: Kees Cook Cc: Tejun Heo Cc: Andrew Morton Cc: Andrew Vagin Cc: Eric W. Biederman Cc: H. Peter Anvin Cc: Serge Hallyn Cc: Pavel Emelyanov Cc: Vasiliy Kulikov Cc: KAMEZAWA Hiroyuki Cc: Michael Kerrisk Cc: Julien Tinnes --- kernel/sys.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) Index: linux-2.6.git/kernel/sys.c =================================================================== --- linux-2.6.git.orig/kernel/sys.c +++ linux-2.6.git/kernel/sys.c @@ -1838,22 +1838,28 @@ static int prctl_set_mm_map(int opt, con if (copy_from_user(&prctl_map, addr, sizeof(prctl_map))) return -EFAULT; - down_read(&mm->mmap_sem); - - if (validate_prctl_map_locked(&prctl_map)) - goto out; - + /* + * Validate and copy auxv early to be able to keep + * @mmap_sem taken until this function ends. + */ if (prctl_map.auxv_size) { - up_read(&mm->mmap_sem); + if (!prctl_map.auxv || + prctl_map.auxv_size > sizeof(mm->saved_auxv)) + return -EINVAL; + memset(user_auxv, 0, sizeof(user_auxv)); error = copy_from_user(user_auxv, (const void __user *)prctl_map.auxv, prctl_map.auxv_size); - down_read(&mm->mmap_sem); if (error) goto out; } + down_read(&mm->mmap_sem); + + if (validate_prctl_map_locked(&prctl_map)) + goto out; + if (prctl_map.exe_fd != (u32)-1) { error = prctl_set_mm_exe_file_locked(mm, prctl_map.exe_fd); if (error)