The patch titled Subject: syscalls, x86: Fix __NR_kcmp execve race and potential NULL dereference has been added to the -mm tree. Its filename is syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix-fix-fix.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Cyrill Gorcunov <gorcunov@xxxxxxxxxx> Subject: syscalls, x86: Fix __NR_kcmp execve race and potential NULL dereference Plain ptrace_may_access() check used in kcmp is not safe against race with execve(setuid_app), so we need to grab cred_guard_mutex and keep it until kcmp is finished. Also task->files may be nil, better to use task_lock and fcheck_files helpers instead of direct file_lock usage. Reported-by: Oleg Nesterov <oleg@xxxxxxxxxx> Signed-off-by: Cyrill Gorcunov <gorcunov@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/kcmp.c | 48 +++++++++++++++++++++++++++++++++++------------- 1 file changed, 35 insertions(+), 13 deletions(-) diff -puN kernel/kcmp.c~syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix-fix-fix kernel/kcmp.c --- a/kernel/kcmp.c~syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix-fix-fix +++ a/kernel/kcmp.c @@ -44,20 +44,38 @@ static int kcmp_ptr(void *v1, void *v2, static struct file * get_file_raw_ptr(struct task_struct *task, unsigned int idx) { - struct fdtable *fdt; - struct file *file; + struct file *file = NULL; - spin_lock(&task->files->file_lock); - fdt = files_fdtable(task->files); - if (idx < fdt->max_fds) - file = fdt->fd[idx]; - else - file = NULL; - spin_unlock(&task->files->file_lock); + task_lock(task); + rcu_read_lock(); + + if (task->files) + file = fcheck_files(task->files, idx); + + rcu_read_unlock(); + task_unlock(task); return file; } +static void access_unlock(struct task_struct *task) +{ + mutex_unlock(&task->signal->cred_guard_mutex); +} + +static int access_trylock(struct task_struct *task) +{ + if (!mutex_trylock(&task->signal->cred_guard_mutex)) + return -EBUSY; + + if (!ptrace_may_access(task, PTRACE_MODE_READ)) { + mutex_unlock(&task->signal->cred_guard_mutex); + return -EPERM; + } + + return 0; +} + SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type, unsigned long, idx1, unsigned long, idx2) { @@ -82,11 +100,12 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t /* * One should have enough rights to inspect task details. */ - if (!ptrace_may_access(task1, PTRACE_MODE_READ) || - !ptrace_may_access(task2, PTRACE_MODE_READ)) { - ret = -EACCES; + ret = access_trylock(task1); + if (ret) goto err; - } + ret = access_trylock(task2); + if (ret) + goto err_unlock; switch (type) { case KCMP_FILE: { @@ -130,6 +149,9 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t break; } + access_unlock(task2); +err_unlock: + access_unlock(task1); err: put_task_struct(task1); put_task_struct(task2); _ Subject: Subject: syscalls, x86: Fix __NR_kcmp execve race and potential NULL dereference Patches currently in -mm which might be from gorcunov@xxxxxxxxxx are linux-next.patch sysctl-make-kernelns_last_pid-control-being-checkpoint_restore-dependent.patch fs-proc-introduce-proc-pid-task-tid-children-entry-v9.patch syscalls-x86-add-__nr_kcmp-syscall-v8.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix-fix.patch syscalls-x86-add-__nr_kcmp-syscall-v8-fix-fix-fix-fix.patch c-r-procfs-add-arg_start-end-env_start-end-and-exit_code-members-to-proc-pid-stat.patch c-r-prctl-extend-pr_set_mm-to-set-up-more-mm_struct-entries-v2.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html