All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2 (resend)] fs: Allow opening only regular files during execve().
@ 2019-03-08 11:20 Tetsuo Handa
  2019-03-08 15:45 ` Kees Cook
  0 siblings, 1 reply; 2+ messages in thread
From: Tetsuo Handa @ 2019-03-08 11:20 UTC (permalink / raw)
  To: Al Viro
  Cc: Eric Biggers, Dmitry Vyukov, Kees Cook, Andrew Morton,
	linux-fsdevel, Tetsuo Handa, syzbot

syzbot is hitting lockdep warning [1] due to trying to open a fifo during
an execve() operation. But we don't need to open non regular files during
an execve() operation, for all files which we will need are the executable
file itself and the interpreter programs like /bin/sh and ld-linux.so.2 .

Since the manpage for execve(2) says that execve() returns EACCES when
the file or a script interpreter is not a regular file, and the manpage
for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC
when opening for execve()/uselib(), we can bail out if a non regular file
is requested with FMODE_EXEC set.

Since this deadlock followed by khungtaskd warnings is trivially
reproducible by a local unprivileged user, and syzbot's frequent
crash due to this deadlock defers finding other bugs, let's workaround
this deadlock until we get a chance to find a better solution.

[1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce

Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 8924feff66f35fe2 ("splice: lift pipe_lock out of splice_to_pipe()")
Cc: <stable@vger.kernel.org> # 4.9+
---
 fs/open.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/open.c b/fs/open.c
index 0285ce7..f1c2f85 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
 		return 0;
 	}
 
+	/* Any file opened for execve()/uselib() has to be a regular file. */
+	if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
+		error = -EACCES;
+		goto cleanup_file;
+	}
+
 	if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
 		error = get_write_access(inode);
 		if (unlikely(error))
-- 
1.8.3.1


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH v2 (resend)] fs: Allow opening only regular files during execve().
  2019-03-08 11:20 [PATCH v2 (resend)] fs: Allow opening only regular files during execve() Tetsuo Handa
@ 2019-03-08 15:45 ` Kees Cook
  0 siblings, 0 replies; 2+ messages in thread
From: Kees Cook @ 2019-03-08 15:45 UTC (permalink / raw)
  To: Tetsuo Handa, Andrew Morton
  Cc: Al Viro, Eric Biggers, Dmitry Vyukov, linux-fsdevel, syzbot

On Fri, Mar 8, 2019 at 3:20 AM Tetsuo Handa
<penguin-kernel@i-love.sakura.ne.jp> wrote:
>
> syzbot is hitting lockdep warning [1] due to trying to open a fifo during
> an execve() operation. But we don't need to open non regular files during
> an execve() operation, for all files which we will need are the executable
> file itself and the interpreter programs like /bin/sh and ld-linux.so.2 .
>
> Since the manpage for execve(2) says that execve() returns EACCES when
> the file or a script interpreter is not a regular file, and the manpage
> for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC
> when opening for execve()/uselib(), we can bail out if a non regular file
> is requested with FMODE_EXEC set.
>
> Since this deadlock followed by khungtaskd warnings is trivially
> reproducible by a local unprivileged user, and syzbot's frequent
> crash due to this deadlock defers finding other bugs, let's workaround
> this deadlock until we get a chance to find a better solution.
>
> [1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce
>
> Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Fixes: 8924feff66f35fe2 ("splice: lift pipe_lock out of splice_to_pipe()")
> Cc: <stable@vger.kernel.org> # 4.9+

Acked-by: Kees Cook <keescook@chromium.org>

Andrew, can you take this for -mm?

-Kees

> ---
>  fs/open.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/fs/open.c b/fs/open.c
> index 0285ce7..f1c2f85 100644
> --- a/fs/open.c
> +++ b/fs/open.c
> @@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
>                 return 0;
>         }
>
> +       /* Any file opened for execve()/uselib() has to be a regular file. */
> +       if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
> +               error = -EACCES;
> +               goto cleanup_file;
> +       }
> +
>         if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
>                 error = get_write_access(inode);
>                 if (unlikely(error))
> --
> 1.8.3.1
>


-- 
Kees Cook

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2019-03-08 15:45 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-03-08 11:20 [PATCH v2 (resend)] fs: Allow opening only regular files during execve() Tetsuo Handa
2019-03-08 15:45 ` Kees Cook

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.