From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7E19C433DB for ; Mon, 22 Feb 2021 09:57:17 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7279E64E5F for ; Mon, 22 Feb 2021 09:57:17 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7279E64E5F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EB6196B007B; Mon, 22 Feb 2021 04:57:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id E3E8F8D0001; Mon, 22 Feb 2021 04:57:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D2E766B007E; Mon, 22 Feb 2021 04:57:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0230.hostedemail.com [216.40.44.230]) by kanga.kvack.org (Postfix) with ESMTP id BF6F16B007B for ; Mon, 22 Feb 2021 04:57:14 -0500 (EST) Received: from smtpin19.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 8F7755DD5 for ; Mon, 22 Feb 2021 09:57:14 +0000 (UTC) X-FDA: 77845450788.19.E038813 Received: from raptor.unsafe.ru (raptor.unsafe.ru [5.9.43.93]) by imf21.hostedemail.com (Postfix) with ESMTP id 1E213E0011E6 for ; Mon, 22 Feb 2021 09:57:10 +0000 (UTC) Received: from comp-core-i7-2640m-0182e6.redhat.com (ip-94-113-225-162.net.upcbroadband.cz [94.113.225.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by raptor.unsafe.ru (Postfix) with ESMTPSA id 991C020A0A; Mon, 22 Feb 2021 09:57:12 +0000 (UTC) From: Alexey Gladkov To: LKML , io-uring@vger.kernel.org, Kernel Hardening , Linux Containers , linux-mm@kvack.org Cc: Alexey Gladkov , Andrew Morton , Christian Brauner , "Eric W . Biederman" , Jann Horn , Jens Axboe , Kees Cook , Linus Torvalds , Oleg Nesterov , kernel test robot Subject: [PATCH v7 2/7] Add a reference to ucounts for each cred Date: Mon, 22 Feb 2021 10:56:27 +0100 Message-Id: <8495980367f9d7ba7cf7a95d3886f8cbf76c0d6c.1613987704.git.gladkov.alexey@gmail.com> X-Mailer: git-send-email 2.29.2 In-Reply-To: References: MIME-Version: 1.0 X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.6.1 (raptor.unsafe.ru [5.9.43.93]); Mon, 22 Feb 2021 09:57:13 +0000 (UTC) X-Stat-Signature: 6dao9tcddotzxy5sfgf6ems5cry86a67 X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 1E213E0011E6 Received-SPF: none (gmail.com>: No applicable sender policy available) receiver=imf21; identity=mailfrom; envelope-from=""; helo=raptor.unsafe.ru; client-ip=5.9.43.93 X-HE-DKIM-Result: none/none X-HE-Tag: 1613987830-9923 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: For RLIMIT_NPROC and some other rlimits the user_struct that holds the global limit is kept alive for the lifetime of a process by keeping it in struct cred. Adding a pointer to ucounts in the struct cred will allow to track RLIMIT_NPROC not only for user in the system, but for user in the user_namespace. Updating ucounts may require memory allocation which may fail. So, we cannot change cred.ucounts in the commit_creds() because this function cannot fail and it should always return 0. For this reason, we modify cred.ucounts before calling the commit_creds(). Changelog v6: * Fix null-ptr-deref in is_ucounts_overlimit() detected by trinity. This error was caused by the fact that cred_alloc_blank() left the ucounts pointer empty. Reported-by: kernel test robot Signed-off-by: Alexey Gladkov --- fs/exec.c | 4 ++++ include/linux/cred.h | 2 ++ include/linux/user_namespace.h | 4 ++++ kernel/cred.c | 40 ++++++++++++++++++++++++++++++++++ kernel/fork.c | 6 +++++ kernel/sys.c | 12 ++++++++++ kernel/ucount.c | 40 +++++++++++++++++++++++++++++++--- kernel/user_namespace.c | 3 +++ 8 files changed, 108 insertions(+), 3 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 5d4d52039105..0371a3400be5 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1360,6 +1360,10 @@ int begin_new_exec(struct linux_binprm * bprm) WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1); flush_signal_handlers(me, 0); =20 + retval =3D set_cred_ucounts(bprm->cred); + if (retval < 0) + goto out_unlock; + /* * install the new credentials for this executable */ diff --git a/include/linux/cred.h b/include/linux/cred.h index 18639c069263..ad160e5fe5c6 100644 --- a/include/linux/cred.h +++ b/include/linux/cred.h @@ -144,6 +144,7 @@ struct cred { #endif struct user_struct *user; /* real user ID subscription */ struct user_namespace *user_ns; /* user_ns the caps and keyrings are re= lative to. */ + struct ucounts *ucounts; struct group_info *group_info; /* supplementary groups for euid/fsgid *= / /* RCU deletion */ union { @@ -170,6 +171,7 @@ extern int set_security_override_from_ctx(struct cred= *, const char *); extern int set_create_files_as(struct cred *, struct inode *); extern int cred_fscmp(const struct cred *, const struct cred *); extern void __init cred_init(void); +extern int set_cred_ucounts(struct cred *); =20 /* * check for validity of credentials diff --git a/include/linux/user_namespace.h b/include/linux/user_namespac= e.h index 0bb833fd41f4..f71b5a4a3e74 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -97,11 +97,15 @@ struct ucounts { }; =20 extern struct user_namespace init_user_ns; +extern struct ucounts init_ucounts; =20 bool setup_userns_sysctls(struct user_namespace *ns); void retire_userns_sysctls(struct user_namespace *ns); struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid, enum u= count_type type); void dec_ucount(struct ucounts *ucounts, enum ucount_type type); +struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid); +struct ucounts *get_ucounts(struct ucounts *ucounts); +void put_ucounts(struct ucounts *ucounts); =20 #ifdef CONFIG_USER_NS =20 diff --git a/kernel/cred.c b/kernel/cred.c index 421b1149c651..58a8a9e24347 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -60,6 +60,7 @@ struct cred init_cred =3D { .user =3D INIT_USER, .user_ns =3D &init_user_ns, .group_info =3D &init_groups, + .ucounts =3D &init_ucounts, }; =20 static inline void set_cred_subscribers(struct cred *cred, int n) @@ -119,6 +120,8 @@ static void put_cred_rcu(struct rcu_head *rcu) if (cred->group_info) put_group_info(cred->group_info); free_uid(cred->user); + if (cred->ucounts) + put_ucounts(cred->ucounts); put_user_ns(cred->user_ns); kmem_cache_free(cred_jar, cred); } @@ -222,6 +225,7 @@ struct cred *cred_alloc_blank(void) #ifdef CONFIG_DEBUG_CREDENTIALS new->magic =3D CRED_MAGIC; #endif + new->ucounts =3D get_ucounts(&init_ucounts); =20 if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) goto error; @@ -284,6 +288,11 @@ struct cred *prepare_creds(void) =20 if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) goto error; + + new->ucounts =3D get_ucounts(new->ucounts); + if (!new->ucounts) + goto error; + validate_creds(new); return new; =20 @@ -363,6 +372,8 @@ int copy_creds(struct task_struct *p, unsigned long c= lone_flags) ret =3D create_user_ns(new); if (ret < 0) goto error_put; + if (set_cred_ucounts(new) < 0) + goto error_put; } =20 #ifdef CONFIG_KEYS @@ -653,6 +664,31 @@ int cred_fscmp(const struct cred *a, const struct cr= ed *b) } EXPORT_SYMBOL(cred_fscmp); =20 +int set_cred_ucounts(struct cred *new) +{ + struct task_struct *task =3D current; + const struct cred *old =3D task->real_cred; + struct ucounts *old_ucounts =3D new->ucounts; + + if (new->user =3D=3D old->user && new->user_ns =3D=3D old->user_ns) + return 0; + + /* + * This optimization is needed because alloc_ucounts() uses locks + * for table lookups. + */ + if (old_ucounts && old_ucounts->ns =3D=3D new->user_ns && uid_eq(old_uc= ounts->uid, new->euid)) + return 0; + + if (!(new->ucounts =3D alloc_ucounts(new->user_ns, new->euid))) + return -EAGAIN; + + if (old_ucounts) + put_ucounts(old_ucounts); + + return 0; +} + /* * initialise the credentials stuff */ @@ -719,6 +755,10 @@ struct cred *prepare_kernel_cred(struct task_struct = *daemon) if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) goto error; =20 + new->ucounts =3D get_ucounts(new->ucounts); + if (!new->ucounts) + goto error; + put_cred(old); validate_creds(new); return new; diff --git a/kernel/fork.c b/kernel/fork.c index d66cd1014211..40a5da7d3d70 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2957,6 +2957,12 @@ int ksys_unshare(unsigned long unshare_flags) if (err) goto bad_unshare_cleanup_cred; =20 + if (new_cred) { + err =3D set_cred_ucounts(new_cred); + if (err) + goto bad_unshare_cleanup_cred; + } + if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) { if (do_sysvsem) { /* diff --git a/kernel/sys.c b/kernel/sys.c index 51f00fe20e4d..373def7debe8 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -553,6 +553,10 @@ long __sys_setreuid(uid_t ruid, uid_t euid) if (retval < 0) goto error; =20 + retval =3D set_cred_ucounts(new); + if (retval < 0) + goto error; + return commit_creds(new); =20 error: @@ -611,6 +615,10 @@ long __sys_setuid(uid_t uid) if (retval < 0) goto error; =20 + retval =3D set_cred_ucounts(new); + if (retval < 0) + goto error; + return commit_creds(new); =20 error: @@ -686,6 +694,10 @@ long __sys_setresuid(uid_t ruid, uid_t euid, uid_t s= uid) if (retval < 0) goto error; =20 + retval =3D set_cred_ucounts(new); + if (retval < 0) + goto error; + return commit_creds(new); =20 error: diff --git a/kernel/ucount.c b/kernel/ucount.c index 04c561751af1..50cc1dfb7d28 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -8,6 +8,12 @@ #include #include =20 +struct ucounts init_ucounts =3D { + .ns =3D &init_user_ns, + .uid =3D GLOBAL_ROOT_UID, + .count =3D 1, +}; + #define UCOUNTS_HASHTABLE_BITS 10 static struct hlist_head ucounts_hashtable[(1 << UCOUNTS_HASHTABLE_BITS)= ]; static DEFINE_SPINLOCK(ucounts_lock); @@ -125,7 +131,15 @@ static struct ucounts *find_ucounts(struct user_name= space *ns, kuid_t uid, struc return NULL; } =20 -static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid= ) +static void hlist_add_ucounts(struct ucounts *ucounts) +{ + struct hlist_head *hashent =3D ucounts_hashentry(ucounts->ns, ucounts->= uid); + spin_lock_irq(&ucounts_lock); + hlist_add_head(&ucounts->node, hashent); + spin_unlock_irq(&ucounts_lock); +} + +struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) { struct hlist_head *hashent =3D ucounts_hashentry(ns, uid); struct ucounts *ucounts, *new; @@ -160,7 +174,26 @@ static struct ucounts *get_ucounts(struct user_names= pace *ns, kuid_t uid) return ucounts; } =20 -static void put_ucounts(struct ucounts *ucounts) +struct ucounts *get_ucounts(struct ucounts *ucounts) +{ + unsigned long flags; + + if (!ucounts) + return NULL; + + spin_lock_irqsave(&ucounts_lock, flags); + if (ucounts->count =3D=3D INT_MAX) { + WARN_ONCE(1, "ucounts: counter has reached its maximum value"); + ucounts =3D NULL; + } else { + ucounts->count +=3D 1; + } + spin_unlock_irqrestore(&ucounts_lock, flags); + + return ucounts; +} + +void put_ucounts(struct ucounts *ucounts) { unsigned long flags; =20 @@ -194,7 +227,7 @@ struct ucounts *inc_ucount(struct user_namespace *ns,= kuid_t uid, { struct ucounts *ucounts, *iter, *bad; struct user_namespace *tns; - ucounts =3D get_ucounts(ns, uid); + ucounts =3D alloc_ucounts(ns, uid); for (iter =3D ucounts; iter; iter =3D tns->ucounts) { long max; tns =3D iter->ns; @@ -237,6 +270,7 @@ static __init int user_namespace_sysctl_init(void) BUG_ON(!user_header); BUG_ON(!setup_userns_sysctls(&init_user_ns)); #endif + hlist_add_ucounts(&init_ucounts); return 0; } subsys_initcall(user_namespace_sysctl_init); diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index af612945a4d0..516db53166ab 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -1281,6 +1281,9 @@ static int userns_install(struct nsset *nsset, stru= ct ns_common *ns) put_user_ns(cred->user_ns); set_cred_user_ns(cred, get_user_ns(user_ns)); =20 + if (set_cred_ucounts(cred) < 0) + return -EINVAL; + return 0; } =20 --=20 2.29.2