Re: + syscalls-x86-add-__nr_kcmp-syscall-v8.patch added to -mm tree

Cyrill Gorcunov
2012-02-15T21:58:13Z

[-- Attachment #1: Type: text/plain, Size: 619 bytes --]

On Thu, Feb 16, 2012 at 01:09:34AM +0400, Cyrill Gorcunov wrote:
> On Thu, Feb 16, 2012 at 12:25:38AM +0400, Cyrill Gorcunov wrote:
> >
> > Something like below I think (not yet tested, overall update).
> >
>
> OK, this one I've just tested. Please review, so I won't miss
> something obvious (I'm fetching linux-next now, if the patch
> is already there I'll cook one on top).
> ---

Unfortunately I dont see this patch in linux-next, so I cooked
it as interdiff'ed. Please review.

Maybe (if this patch is fine) we could drop v8 and I would
squash this changed into v9 (together with update to self
test)?

Cyrill

[-- Attachment #2: sys-kcmp-interdiff --]
[-- Type: text/plain, Size: 2197 bytes --]

From: Cyrill Gorcunov <gorcunov@openvz.org>
Subject: syscalls, x86: Fix __NR_kcmp execve race and potential NULL dereference

Plain ptrace_may_access() check used in kcmp is not safe
against race with execve(setuid_app), so we need to grab
cred_guard_mutex and keep it until kcmp is finished.

Also task->files may be nil, better to use task_lock
and fcheck_files helpers instead of direct file_lock
usage.

Reported-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
---
diff -u linux-2.6.git/kernel/kcmp.c linux-2.6.git/kernel/kcmp.c
--- linux-2.6.git/kernel/kcmp.c
+++ linux-2.6.git/kernel/kcmp.c
@@ -44,20 +44,38 @@
static struct file *
get_file_raw_ptr(struct task_struct *task, unsigned int idx)
{
- struct fdtable *fdt;
- struct file *file;
+ struct file *file = NULL;

- spin_lock(&task->files->file_lock);
- fdt = files_fdtable(task->files);
- if (idx < fdt->max_fds)
- file = fdt->fd[idx];
- else
- file = NULL;
- spin_unlock(&task->files->file_lock);
+ task_lock(task);
+ rcu_read_lock();
+
+ if (task->files)
+ file = fcheck_files(task->files, idx);
+
+ rcu_read_unlock();
+ task_unlock(task);

return file;
}

+static void access_unlock(struct task_struct *task)
+{
+ mutex_unlock(&task->signal->cred_guard_mutex);
+}
+
+static int access_trylock(struct task_struct *task)
+{
+ if (!mutex_trylock(&task->signal->cred_guard_mutex))
+ return -EBUSY;
+
+ if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
+ mutex_unlock(&task->signal->cred_guard_mutex);
+ return -EPERM;
+ }
+
+ return 0;
+}
+
SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
unsigned long, idx1, unsigned long, idx2)
{
@@ -82,11 +100,12 @@
/*
* One should have enough rights to inspect task details.
*/
- if (!ptrace_may_access(task1, PTRACE_MODE_READ) ||
- !ptrace_may_access(task2, PTRACE_MODE_READ)) {
- ret = -EACCES;
+ ret = access_trylock(task1);
+ if (ret)
goto err;
- }
+ ret = access_trylock(task2);
+ if (ret)
+ goto err_unlock;

switch (type) {
case KCMP_FILE: {
@@ -130,6 +149,9 @@
break;
}

+ access_unlock(task2);
+err_unlock:
+ access_unlock(task1);
err:
put_task_struct(task1);
put_task_struct(task2);