Re: [PATCH v2 (resend)] fs: Allow opening only regular files during execve().

[Kees Cook <keescook@chromium.org>]

On Fri, Mar 8, 2019 at 3:20 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
>
> syzbot is hitting lockdep warning [1] due to trying to open a fifo during
> an execve() operation. But we don't need to open non regular files during
> an execve() operation, for all files which we will need are the executable
> file itself and the interpreter programs like /bin/sh and ld-linux.so.2 .
>
> Since the manpage for execve(2) says that execve() returns EACCES when
> the file or a script interpreter is not a regular file, and the manpage
> for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC
> when opening for execve()/uselib(), we can bail out if a non regular file
> is requested with FMODE_EXEC set.
>
> Since this deadlock followed by khungtaskd warnings is trivially
> reproducible by a local unprivileged user, and syzbot's frequent
> crash due to this deadlock defers finding other bugs, let's workaround
> this deadlock until we get a chance to find a better solution.
>
> [1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce
>
> Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Fixes: 8924feff66f35fe2 ("splice: lift pipe_lock out of splice_to_pipe()")
> Cc: <stable@vger.kernel.org> # 4.9+

Acked-by: Kees Cook <keescook@chromium.org>

Andrew, can you take this for -mm?

-Kees

> ---
>  fs/open.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/fs/open.c b/fs/open.c
> index 0285ce7..f1c2f85 100644
> --- a/fs/open.c
> +++ b/fs/open.c
> @@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
>                 return 0;
>         }
>
> +       /* Any file opened for execve()/uselib() has to be a regular file. */
> +       if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
> +               error = -EACCES;
> +               goto cleanup_file;
> +       }
> +
>         if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
>                 error = get_write_access(inode);
>                 if (unlikely(error))
> --
> 1.8.3.1
>


-- 
Kees Cook