From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3731018FDB4; Sun, 23 Jun 2024 13:44:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719150297; cv=none; b=jOWGp+rrVvFgndM8fZD6ExtF5rTYw56iepdavbRVOTv6tVowRRtt73la24k7pc/Cto/nEzA+ew/PbOQAq+y0p2xWgminAnoJ7RSwUx39ySzNFKo9xE0Yd7jX13aMlTc5o9H4Yz5vXbe8EGoM6hHn+MvqXjKqf4I5SwC+kMaSzEk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1719150297; c=relaxed/simple; bh=r/b0ciWjzISWnepJ9kFySb3gDAWmKtarJfO9wtHGBrs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BEvndthMVW1OEybHMSv9GHlPaAQpXV5tynL285ijQ5XtUo9my2pfXdNg52vdU6XN94FV1NYbGaKTI2ql0l23HBg5EVBGHW/CydcTXePPa3Mcp0utBdcrnR+Ce7+rNFnXW8yc1TQUPEGJnYaIzuVkDOPYTMvc6+ZIGZv00ZUv03M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BlvNTW7f; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BlvNTW7f" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16560C32781; Sun, 23 Jun 2024 13:44:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1719150297; bh=r/b0ciWjzISWnepJ9kFySb3gDAWmKtarJfO9wtHGBrs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BlvNTW7fSgPClqhHWR34v9nyHzygGLlSazUHQwitX+wRqr5WgxW4Jlk4B/4WIc1IT 39ua0sO2EQTtONIZPRGZc7hnkLBcSPacT2gX1UEcuntpedmUDK4Ybu/qYPNiQk86dJ F08H7lzc4iFFcurRkYjMKVtsdZXxLXiqJJFdN29WtXNwQy9T2ikSgPh1yKJaVwUm4i YYf+auxhLFPO6UqxNEEKza82wve/RXKdRI2m1BUayPKYBwd9WUoG3LNixCZvYfrSod POkvQNJuShm2ltm7O64NoDKFMq3lwRgC2BOM9jrRxRIOs1ANLdOgoXmL5tKfHPOpXr 3ZRFDNP8XJGxA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Baokun Li , Jeff Layton , Jingbo Xu , Christian Brauner , Sasha Levin , dhowells@redhat.com, netfs@lists.linux.dev Subject: [PATCH AUTOSEL 6.6 05/16] cachefiles: add consistency check for copen/cread Date: Sun, 23 Jun 2024 09:44:34 -0400 Message-ID: <20240623134448.809470-5-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240623134448.809470-1-sashal@kernel.org> References: <20240623134448.809470-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: netfs@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.6.35 Content-Transfer-Encoding: 8bit From: Baokun Li [ Upstream commit a26dc49df37e996876f50a0210039b2d211fdd6f ] This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Generic, copen can only complete open requests, and cread can only complete read requests. * For copen, ondemand_id must not be 0, because this indicates that the request has not been read by the daemon. * For cread, the object corresponding to fd and req should be the same. Signed-off-by: Baokun Li Link: https://lore.kernel.org/r/20240522114308.2402121-7-libaokun@huaweicloud.com Acked-by: Jeff Layton Reviewed-by: Jingbo Xu Signed-off-by: Christian Brauner Signed-off-by: Sasha Levin --- fs/cachefiles/ondemand.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c index 4b39f0422e590..b8e9cdc93643e 100644 --- a/fs/cachefiles/ondemand.c +++ b/fs/cachefiles/ondemand.c @@ -97,12 +97,12 @@ static loff_t cachefiles_ondemand_fd_llseek(struct file *filp, loff_t pos, } static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl, - unsigned long arg) + unsigned long id) { struct cachefiles_object *object = filp->private_data; struct cachefiles_cache *cache = object->volume->cache; struct cachefiles_req *req; - unsigned long id; + XA_STATE(xas, &cache->reqs, id); if (ioctl != CACHEFILES_IOC_READ_COMPLETE) return -EINVAL; @@ -110,10 +110,15 @@ static long cachefiles_ondemand_fd_ioctl(struct file *filp, unsigned int ioctl, if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags)) return -EOPNOTSUPP; - id = arg; - req = xa_erase(&cache->reqs, id); - if (!req) + xa_lock(&cache->reqs); + req = xas_load(&xas); + if (!req || req->msg.opcode != CACHEFILES_OP_READ || + req->object != object) { + xa_unlock(&cache->reqs); return -EINVAL; + } + xas_store(&xas, NULL); + xa_unlock(&cache->reqs); trace_cachefiles_ondemand_cread(object, id); complete(&req->done); @@ -142,6 +147,7 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) unsigned long id; long size; int ret; + XA_STATE(xas, &cache->reqs, 0); if (!test_bit(CACHEFILES_ONDEMAND_MODE, &cache->flags)) return -EOPNOTSUPP; @@ -165,9 +171,16 @@ int cachefiles_ondemand_copen(struct cachefiles_cache *cache, char *args) if (ret) return ret; - req = xa_erase(&cache->reqs, id); - if (!req) + xa_lock(&cache->reqs); + xas.xa_index = id; + req = xas_load(&xas); + if (!req || req->msg.opcode != CACHEFILES_OP_OPEN || + !req->object->ondemand->ondemand_id) { + xa_unlock(&cache->reqs); return -EINVAL; + } + xas_store(&xas, NULL); + xa_unlock(&cache->reqs); /* fail OPEN request if copen format is invalid */ ret = kstrtol(psize, 0, &size); -- 2.43.0