On Fri, Mar 8, 2019 at 3:20 AM Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote: > > syzbot is hitting lockdep warning [1] due to trying to open a fifo during > an execve() operation. But we don't need to open non regular files during > an execve() operation, for all files which we will need are the executable > file itself and the interpreter programs like /bin/sh and ld-linux.so.2 . > > Since the manpage for execve(2) says that execve() returns EACCES when > the file or a script interpreter is not a regular file, and the manpage > for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC > when opening for execve()/uselib(), we can bail out if a non regular file > is requested with FMODE_EXEC set. > > Since this deadlock followed by khungtaskd warnings is trivially > reproducible by a local unprivileged user, and syzbot's frequent > crash due to this deadlock defers finding other bugs, let's workaround > this deadlock until we get a chance to find a better solution. > > [1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce > > Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@xxxxxxxxxxxxxxxxxxxxxxxxx> > Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx> > Fixes: 8924feff66f35fe2 ("splice: lift pipe_lock out of splice_to_pipe()") > Cc: <stable@xxxxxxxxxxxxxxx> # 4.9+ Acked-by: Kees Cook <keescook@xxxxxxxxxxxx> Andrew, can you take this for -mm? -Kees > --- > fs/open.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/fs/open.c b/fs/open.c > index 0285ce7..f1c2f85 100644 > --- a/fs/open.c > +++ b/fs/open.c > @@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f, > return 0; > } > > + /* Any file opened for execve()/uselib() has to be a regular file. */ > + if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) { > + error = -EACCES; > + goto cleanup_file; > + } > + > if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { > error = get_write_access(inode); > if (unlikely(error)) > -- > 1.8.3.1 > -- Kees Cook
