From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751923AbdFPDa5 (ORCPT ); Thu, 15 Jun 2017 23:30:57 -0400 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:40767 "EHLO out3-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750981AbdFPDa4 (ORCPT ); Thu, 15 Jun 2017 23:30:56 -0400 X-Greylist: delayed 647 seconds by postgrey-1.27 at vger.kernel.org; Thu, 15 Jun 2017 23:30:55 EDT X-ME-Sender: X-Sasl-enc: aX1j9FuxfRmiOl41rUzIeGNfao2s/dXBPRoOZBxvoNSx 1497583207 Message-ID: <1497583202.2553.1.camel@themaw.net> Subject: Re: [PATCH] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL From: Ian Kent To: NeilBrown , Andrew Morton Cc: LKML , autofs mailing list Date: Fri, 16 Jun 2017 11:20:02 +0800 In-Reply-To: <87fuf07k84.fsf@notabene.neil.brown.name> References: <871sqwczx5.fsf@notabene.neil.brown.name> <20170615163400.e2f024125581f452d48f1aca@linux-foundation.org> <87fuf07k84.fsf@notabene.neil.brown.name> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.22.6 (3.22.6-2.fc25) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2017-06-16 at 12:13 +1000, NeilBrown wrote: > On Thu, Jun 15 2017, Andrew Morton wrote: > > > On Wed, 07 Jun 2017 12:08:38 +1000 NeilBrown wrote: > > > > > > > > If a positive status is passed with the AUTOFS_DEV_IOCTL_FAIL > > > ioctl, autofs4_d_automount() will return > > >    ERR_PTR(status) > > > with that status to follow_automount(), which will then > > > dereference an invalid pointer. > > > > > > So treat a positive status the same as zero, and map > > > to ENOENT. > > > > > > See comment in systemd src/core/automount.c::automount_send_ready(). > > > > > > ... > > > > > > --- a/fs/autofs4/dev-ioctl.c > > > +++ b/fs/autofs4/dev-ioctl.c > > > @@ -344,7 +344,7 @@ static int autofs_dev_ioctl_fail(struct file *fp, > > >   int status; > > >   > > >   token = (autofs_wqt_t) param->fail.token; > > > - status = param->fail.status ? param->fail.status : -ENOENT; > > > + status = param->fail.status < 0 ? param->fail.status : -ENOENT; > > >   return autofs4_wait_release(sbi, token, status); > > >  } > > > > Sounds serious.  Was the absence of a cc:stable deliberate? > > You need CAP_SYS_ADMIN to  get the ioctl even looked at.  Doesn't that > mean the bug can only be triggered by a process that could easily do > worse? Think so, yes. > > Or do containers allow admins to give out CAP_SYS_ADMIN to untrusted > people??  I haven't been keeping up. Maybe, with docker root can start a container with --privileged to give the container admin capabilities. It may be the case that capabilities can be used now I don't know. > > Given how simple the patch is, it probably makes sense to add a > cc:stable, just in case. IMHO it needs to be applied to stable as well. > > Thanks, > NeilBrown