This is a note to let you know that I've just added the patch titled
fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
fsverity-reject-fs_ioc_enable_verity-on-mode-3-fds.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 04839139213cf60d4c5fc792214a08830e294ff8 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@xxxxxxxxxx>
Date: Thu, 6 Apr 2023 14:31:11 -0700
Subject: fsverity: reject FS_IOC_ENABLE_VERITY on mode 3 fds
From: Eric Biggers <ebiggers@xxxxxxxxxx>
commit 04839139213cf60d4c5fc792214a08830e294ff8 upstream.
Commit 56124d6c87fd ("fsverity: support enabling with tree block size <
PAGE_SIZE") changed FS_IOC_ENABLE_VERITY to use __kernel_read() to read
the file's data, instead of direct pagecache accesses.
An unintended consequence of this is that the
'WARN_ON_ONCE(!(file->f_mode & FMODE_READ))' in __kernel_read() became
reachable by fuzz tests. This happens if FS_IOC_ENABLE_VERITY is called
on a fd opened with access mode 3, which means "ioctl access only".
Arguably, FS_IOC_ENABLE_VERITY should work on ioctl-only fds. But
ioctl-only fds are a weird Linux extension that is rarely used and that
few people even know about. (The documentation for FS_IOC_ENABLE_VERITY
even specifically says it requires O_RDONLY.) It's probably not
worthwhile to make the ioctl internally open a new fd just to handle
this case. Thus, just reject the ioctl on such fds for now.
Fixes: 56124d6c87fd ("fsverity: support enabling with tree block size < PAGE_SIZE")
Reported-by: syzbot+51177e4144d764827c45@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?id=2281afcbbfa8fdb92f9887479cc0e4180f1c6b28
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lore.kernel.org/r/20230406215106.235829-1-ebiggers@xxxxxxxxxx
Reviewed-by: Christoph Hellwig <hch@xxxxxx>
Reviewed-by: Christian Brauner <brauner@xxxxxxxxxx>
Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/verity/enable.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/verity/enable.c
+++ b/fs/verity/enable.c
@@ -347,6 +347,13 @@ int fsverity_ioctl_enable(struct file *f
err = file_permission(filp, MAY_WRITE);
if (err)
return err;
+ /*
+ * __kernel_read() is used while building the Merkle tree. So, we can't
+ * allow file descriptors that were opened for ioctl access only, using
+ * the special nonstandard access mode 3. O_RDONLY only, please!
+ */
+ if (!(filp->f_mode & FMODE_READ))
+ return -EBADF;
if (IS_APPEND(inode))
return -EPERM;
Patches currently in stable-queue which might be from ebiggers@xxxxxxxxxx are
queue-6.3/fsverity-explicitly-check-for-buffer-overflow-in-build_merkle_tree.patch
queue-6.3/fsverity-reject-fs_ioc_enable_verity-on-mode-3-fds.patch
