Commit f6581f5b authored by Jann Horn's avatar Jann Horn Committed by Eric W. Biederman

ptrace: restore smp_rmb() in __ptrace_may_access()

Restore the read memory barrier in __ptrace_may_access() that was deleted
a couple years ago. Also add comments on this barrier and the one it pairs
with to explain why they're there (as far as I understand).

Fixes: bfedb589 ("mm: Add a user_ns owner to mm_struct and fix ptrace permission checks")
Cc: stable@vger.kernel.org
Acked-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarEric W. Biederman <ebiederm@xmission.com>
parent f6e2aa91
...@@ -450,6 +450,15 @@ int commit_creds(struct cred *new) ...@@ -450,6 +450,15 @@ int commit_creds(struct cred *new)
if (task->mm) if (task->mm)
set_dumpable(task->mm, suid_dumpable); set_dumpable(task->mm, suid_dumpable);
task->pdeath_signal = 0; task->pdeath_signal = 0;
/*
* If a task drops privileges and becomes nondumpable,
* the dumpability change must become visible before
* the credential change; otherwise, a __ptrace_may_access()
* racing with this change may be able to attach to a task it
* shouldn't be able to attach to (as if the task had dropped
* privileges without becoming nondumpable).
* Pairs with a read barrier in __ptrace_may_access().
*/
smp_wmb(); smp_wmb();
} }
......
...@@ -323,6 +323,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) ...@@ -323,6 +323,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
return -EPERM; return -EPERM;
ok: ok:
rcu_read_unlock(); rcu_read_unlock();
/*
* If a task drops privileges and becomes nondumpable (through a syscall
* like setresuid()) while we are trying to access it, we must ensure
* that the dumpability is read after the credentials; otherwise,
* we may be able to attach to a task that we shouldn't be able to
* attach to (as if the task had dropped privileges without becoming
* nondumpable).
* Pairs with a write barrier in commit_creds().
*/
smp_rmb();
mm = task->mm; mm = task->mm;
if (mm && if (mm &&
((get_dumpable(mm) != SUID_DUMP_USER) && ((get_dumpable(mm) != SUID_DUMP_USER) &&
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment