All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Dominique Martinet <dominique.martinet@cea.fr>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.9 20/21] 9p locks: fix glock.client_id leak in do_lock
Date: Sun,  4 Nov 2018 08:53:54 -0500	[thread overview]
Message-ID: <20181104135355.88602-20-sashal@kernel.org> (raw)
In-Reply-To: <20181104135355.88602-1-sashal@kernel.org>

From: Dominique Martinet <dominique.martinet@cea.fr>

[ Upstream commit b4dc44b3cac9e8327e0655f530ed0c46f2e6214c ]

the 9p client code overwrites our glock.client_id pointing to a static
buffer by an allocated string holding the network provided value which
we do not care about; free and reset the value as appropriate.

This is almost identical to the leak in v9fs_file_getlock() fixed by
Al Viro in commit ce85dd58ad5a6 ("9p: we are leaking glock.client_id
in v9fs_file_getlock()"), which was returned as an error by a coverity
false positive -- while we are here attempt to make the code slightly
more robust to future change of the net/9p/client code and hopefully
more clear to coverity that there is no problem.

Link: http://lkml.kernel.org/r/1536339057-21974-5-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/9p/vfs_file.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index d7b78d531e63..398a3eddb2df 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
 			break;
 		if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
 			break;
+		/*
+		 * p9_client_lock_dotl overwrites flock.client_id with the
+		 * server message, free and reuse the client name
+		 */
+		if (flock.client_id != fid->clnt->name) {
+			kfree(flock.client_id);
+			flock.client_id = fid->clnt->name;
+		}
 	}
 
 	/* map 9p status to VFS status */
@@ -235,6 +243,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
 		locks_lock_file_wait(filp, fl);
 		fl->fl_type = fl_type;
 	}
+	if (flock.client_id != fid->clnt->name)
+		kfree(flock.client_id);
 out:
 	return res;
 }
@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
 
 	res = p9_client_getlock_dotl(fid, &glock);
 	if (res < 0)
-		return res;
+		goto out;
 	/* map 9p lock type to os lock type */
 	switch (glock.type) {
 	case P9_LOCK_TYPE_RDLCK:
@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
 			fl->fl_end = glock.start + glock.length - 1;
 		fl->fl_pid = glock.proc_id;
 	}
-	kfree(glock.client_id);
+out:
+	if (glock.client_id != fid->clnt->name)
+		kfree(glock.client_id);
 	return res;
 }
 
-- 
2.17.1


  parent reply	other threads:[~2018-11-04 13:54 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-04 13:53 [PATCH AUTOSEL 4.9 01/21] mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 02/21] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 03/21] mm: don't warn about large allocations for slab Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 04/21] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 05/21] tty: check name length in tty_find_polling_driver() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 06/21] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 07/21] powerpc/nohash: fix undefined behaviour when testing page size support Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 08/21] watchdog: lantiq: update register names to better match spec Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 09/21] drm/omap: fix memory barrier bug in DMM driver Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 10/21] iio: adc: at91: fix wrong channel number in triggered buffer mode Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 11/21] iio: adc: at91: fix acking DRDY irq on simple conversions Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 12/21] media: pci: cx23885: handle adding to list failure Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 13/21] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 14/21] MIPS: kexec: Mark CPU offline before disabling local IRQ Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 15/21] powerpc/boot: Ensure _zimage_start is a weak symbol Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 16/21] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 17/21] sc16is7xx: Fix for multi-channel stall Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 18/21] media: tvp5150: fix width alignment during set_selection() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 19/21] powerpc/selftests: Wait all threads to join Sasha Levin
2018-11-04 13:53 ` Sasha Levin [this message]
2018-11-04 13:53 ` [PATCH AUTOSEL 4.9 21/21] 9p: clear dangling pointers in p9stat_free Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181104135355.88602-20-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=dominique.martinet@cea.fr \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.