From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:60061 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751780AbcDPQgi (ORCPT ); Sat, 16 Apr 2016 12:36:38 -0400 Subject: Patch "ppp: ensure file->private_data can't be overridden" has been added to the 4.5-stable tree To: g.nault@alphalink.fr, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Sat, 16 Apr 2016 09:35:31 -0700 Message-ID: <1460824531160152@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ppp: ensure file->private_data can't be overridden to the 4.5-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ppp-ensure-file-private_data-can-t-be-overridden.patch and it can be found in the queue-4.5 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Sat Apr 16 09:15:18 PDT 2016 From: Guillaume Nault Date: Mon, 14 Mar 2016 21:17:16 +0100 Subject: ppp: ensure file->private_data can't be overridden From: Guillaume Nault [ Upstream commit e8e56ffd9d2973398b60ece1f1bebb8d67b4d032 ] Locking ppp_mutex must be done before dereferencing file->private_data, otherwise it could be modified before ppp_unattached_ioctl() takes the lock. This could lead ppp_unattached_ioctl() to override ->private_data, thus leaking reference to the ppp_file previously pointed to. v2: lock all ppp_ioctl() instead of just checking private_data in ppp_unattached_ioctl(), to avoid ambiguous behaviour. Fixes: f3ff8a4d80e8 ("ppp: push BKL down into the driver") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ppp/ppp_generic.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -575,7 +575,7 @@ static int get_filter(void __user *arg, static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { - struct ppp_file *pf = file->private_data; + struct ppp_file *pf; struct ppp *ppp; int err = -EFAULT, val, val2, i; struct ppp_idle idle; @@ -585,9 +585,14 @@ static long ppp_ioctl(struct file *file, void __user *argp = (void __user *)arg; int __user *p = argp; - if (!pf) - return ppp_unattached_ioctl(current->nsproxy->net_ns, - pf, file, cmd, arg); + mutex_lock(&ppp_mutex); + + pf = file->private_data; + if (!pf) { + err = ppp_unattached_ioctl(current->nsproxy->net_ns, + pf, file, cmd, arg); + goto out; + } if (cmd == PPPIOCDETACH) { /* @@ -602,7 +607,6 @@ static long ppp_ioctl(struct file *file, * this fd and reopening /dev/ppp. */ err = -EINVAL; - mutex_lock(&ppp_mutex); if (pf->kind == INTERFACE) { ppp = PF_TO_PPP(pf); rtnl_lock(); @@ -616,15 +620,13 @@ static long ppp_ioctl(struct file *file, } else pr_warn("PPPIOCDETACH file->f_count=%ld\n", atomic_long_read(&file->f_count)); - mutex_unlock(&ppp_mutex); - return err; + goto out; } if (pf->kind == CHANNEL) { struct channel *pch; struct ppp_channel *chan; - mutex_lock(&ppp_mutex); pch = PF_TO_CHANNEL(pf); switch (cmd) { @@ -646,17 +648,16 @@ static long ppp_ioctl(struct file *file, err = chan->ops->ioctl(chan, cmd, arg); up_read(&pch->chan_sem); } - mutex_unlock(&ppp_mutex); - return err; + goto out; } if (pf->kind != INTERFACE) { /* can't happen */ pr_err("PPP: not interface or channel??\n"); - return -EINVAL; + err = -EINVAL; + goto out; } - mutex_lock(&ppp_mutex); ppp = PF_TO_PPP(pf); switch (cmd) { case PPPIOCSMRU: @@ -831,7 +832,10 @@ static long ppp_ioctl(struct file *file, default: err = -ENOTTY; } + +out: mutex_unlock(&ppp_mutex); + return err; } @@ -844,7 +848,6 @@ static int ppp_unattached_ioctl(struct n struct ppp_net *pn; int __user *p = (int __user *)arg; - mutex_lock(&ppp_mutex); switch (cmd) { case PPPIOCNEWUNIT: /* Create a new ppp unit */ @@ -894,7 +897,7 @@ static int ppp_unattached_ioctl(struct n default: err = -ENOTTY; } - mutex_unlock(&ppp_mutex); + return err; } Patches currently in stable-queue which might be from g.nault@alphalink.fr are queue-4.5/ppp-take-reference-on-channels-netns.patch queue-4.5/ppp-ensure-file-private_data-can-t-be-overridden.patch