Commit aa723548 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull ptrace fixes from Eric Biederman:
 "This is just two very minor fixes:

   - prevent ptrace from reading unitialized kernel memory found twice
     by syzkaller

   - restore a missing smp_rmb in ptrace_may_access and add comment tp
     it so it is not removed by accident again.

  Apologies for being a little slow about getting this to you, I am
  still figuring out how to develop with a little baby in the house"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  ptrace: restore smp_rmb() in __ptrace_may_access()
  signal/ptrace: Don't leak unitialized kernel memory with PTRACE_PEEK_SIGINFO
parents 4d8f5f91 f6581f5b
...@@ -446,6 +446,15 @@ int commit_creds(struct cred *new) ...@@ -446,6 +446,15 @@ int commit_creds(struct cred *new)
if (task->mm) if (task->mm)
set_dumpable(task->mm, suid_dumpable); set_dumpable(task->mm, suid_dumpable);
task->pdeath_signal = 0; task->pdeath_signal = 0;
/*
* If a task drops privileges and becomes nondumpable,
* the dumpability change must become visible before
* the credential change; otherwise, a __ptrace_may_access()
* racing with this change may be able to attach to a task it
* shouldn't be able to attach to (as if the task had dropped
* privileges without becoming nondumpable).
* Pairs with a read barrier in __ptrace_may_access().
*/
smp_wmb(); smp_wmb();
} }
......
...@@ -324,6 +324,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) ...@@ -324,6 +324,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
return -EPERM; return -EPERM;
ok: ok:
rcu_read_unlock(); rcu_read_unlock();
/*
* If a task drops privileges and becomes nondumpable (through a syscall
* like setresuid()) while we are trying to access it, we must ensure
* that the dumpability is read after the credentials; otherwise,
* we may be able to attach to a task that we shouldn't be able to
* attach to (as if the task had dropped privileges without becoming
* nondumpable).
* Pairs with a write barrier in commit_creds().
*/
smp_rmb();
mm = task->mm; mm = task->mm;
if (mm && if (mm &&
((get_dumpable(mm) != SUID_DUMP_USER) && ((get_dumpable(mm) != SUID_DUMP_USER) &&
...@@ -705,6 +715,10 @@ static int ptrace_peek_siginfo(struct task_struct *child, ...@@ -705,6 +715,10 @@ static int ptrace_peek_siginfo(struct task_struct *child,
if (arg.nr < 0) if (arg.nr < 0)
return -EINVAL; return -EINVAL;
/* Ensure arg.off fits in an unsigned long */
if (arg.off > ULONG_MAX)
return 0;
if (arg.flags & PTRACE_PEEKSIGINFO_SHARED) if (arg.flags & PTRACE_PEEKSIGINFO_SHARED)
pending = &child->signal->shared_pending; pending = &child->signal->shared_pending;
else else
...@@ -712,18 +726,20 @@ static int ptrace_peek_siginfo(struct task_struct *child, ...@@ -712,18 +726,20 @@ static int ptrace_peek_siginfo(struct task_struct *child,
for (i = 0; i < arg.nr; ) { for (i = 0; i < arg.nr; ) {
kernel_siginfo_t info; kernel_siginfo_t info;
s32 off = arg.off + i; unsigned long off = arg.off + i;
bool found = false;
spin_lock_irq(&child->sighand->siglock); spin_lock_irq(&child->sighand->siglock);
list_for_each_entry(q, &pending->list, list) { list_for_each_entry(q, &pending->list, list) {
if (!off--) { if (!off--) {
found = true;
copy_siginfo(&info, &q->info); copy_siginfo(&info, &q->info);
break; break;
} }
} }
spin_unlock_irq(&child->sighand->siglock); spin_unlock_irq(&child->sighand->siglock);
if (off >= 0) /* beyond the end of the list */ if (!found) /* beyond the end of the list */
break; break;
#ifdef CONFIG_COMPAT #ifdef CONFIG_COMPAT
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment