Linux-Fsdevel Archive on lore.kernel.org
 help / Atom feed
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Eric Biggers <ebiggers3@gmail.com>, Al Viro <viro@zeniv.linux.org.uk>
Cc: Dmitry Vyukov <dvyukov@google.com>,
	Kees Cook <keescook@chromium.org>,
	syzbot 
	<bot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com>,
	"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
	LKML <linux-kernel@vger.kernel.org>,
	syzkaller-bugs <syzkaller-bugs@googlegroups.com>
Subject: [PATCH] fs: Allow opening only regular files during execve().
Date: Mon, 21 Jan 2019 19:14:39 +0900
Message-ID: <d1e2488f-a969-30d4-5023-6fa85a4e3833@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <CACT4Y+aeSz05wDyStT75OFFi_aTyxbfzz7Z6jJ6FJsLNN3Pdtg@mail.gmail.com>

On Tue, Dec 12, 2017 at 2:06 PM, Eric Biggers <ebiggers3@gmail.com> wrote:
> I'm not sure what the fix will be.  Maybe the proc handlers should take a
> different lock instead of cred_guard_mutex.  Or perhaps execve should check that
> the file is a regular file before it attempts to open it.

We can easily distinguish open() from execve() and open() from others. ;-)

From a8c559566f743eeec31c3cf5bab7a90b1ff7f78b Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date: Mon, 21 Jan 2019 13:55:11 +0900
Subject: [PATCH] fs: Allow opening only regular files during execve().

syzbot is hitting lockdep warning [1] due to trying to open a fifo during
an execve() operation. But we don't need to open non regular files during
an execve() operation, for all files which we will need are the executable
file itself, the interpreter program, and libraries like ld-linux.so.2
required by the executable file or the interpreter program.

Since the manpage for execve(2) says that execve() returns EACCES when
the file or a script interpreter is not a regular file, and we set
current->in_execve flag during an execve() operation, let's bail out
when current thread tried to open a non regular file during an execve()
operation.

[1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce

Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
 fs/open.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/open.c b/fs/open.c
index 0285ce7dbd51..b2e7b04ade46 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -733,6 +733,12 @@ static int do_dentry_open(struct file *f,
 		return 0;
 	}
 
+	/* The file or a script interpreter has to be a regular file. */
+	if (unlikely(current->in_execve && !S_ISREG(inode->i_mode))) {
+		error = -EACCES;
+		goto cleanup_file;
+	}
+
 	if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
 		error = get_write_access(inode);
 		if (unlikely(error))
-- 
2.17.1

  reply index

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <001a113f711ae2110c055f45acb8@google.com>
2017-12-02  8:12 ` possible deadlock in seq_read syzbot
2017-12-03 22:02 ` syzbot
2017-12-12 22:06 ` Eric Biggers
2017-12-27 18:30   ` Dmitry Vyukov
2018-08-27 18:20   ` Kees Cook
2018-08-27 20:57     ` Dmitry Vyukov
2019-01-21 10:14       ` Tetsuo Handa [this message]
2019-01-21 20:24         ` [PATCH] fs: Allow opening only regular files during execve() Kees Cook
2019-01-21 21:18         ` Al Viro
2019-01-22  0:50           ` [PATCH v2] " Tetsuo Handa
2019-01-28 23:42             ` Andrew Morton
2019-02-12  2:01               ` Tetsuo Handa
2019-02-12  5:26               ` Tetsuo Handa
2019-02-19  9:51                 ` Tetsuo Handa
2019-01-22  0:51           ` [PATCH] " Kees Cook

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d1e2488f-a969-30d4-5023-6fa85a4e3833@I-love.SAKURA.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=bot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com \
    --cc=dvyukov@google.com \
    --cc=ebiggers3@gmail.com \
    --cc=keescook@chromium.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Fsdevel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-fsdevel/0 linux-fsdevel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-fsdevel linux-fsdevel/ https://lore.kernel.org/linux-fsdevel \
		linux-fsdevel@vger.kernel.org linux-fsdevel@archiver.kernel.org
	public-inbox-index linux-fsdevel


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-fsdevel


AGPL code for this site: git clone https://public-inbox.org/ public-inbox