From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Dominique Martinet <dominique.martinet@cea.fr>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.14 29/30] 9p locks: fix glock.client_id leak in do_lock
Date: Sun, 4 Nov 2018 08:53:24 -0500 [thread overview]
Message-ID: <20181104135325.88524-29-sashal@kernel.org> (raw)
In-Reply-To: <20181104135325.88524-1-sashal@kernel.org>
From: Dominique Martinet <dominique.martinet@cea.fr>
[ Upstream commit b4dc44b3cac9e8327e0655f530ed0c46f2e6214c ]
the 9p client code overwrites our glock.client_id pointing to a static
buffer by an allocated string holding the network provided value which
we do not care about; free and reset the value as appropriate.
This is almost identical to the leak in v9fs_file_getlock() fixed by
Al Viro in commit ce85dd58ad5a6 ("9p: we are leaking glock.client_id
in v9fs_file_getlock()"), which was returned as an error by a coverity
false positive -- while we are here attempt to make the code slightly
more robust to future change of the net/9p/client code and hopefully
more clear to coverity that there is no problem.
Link: http://lkml.kernel.org/r/1536339057-21974-5-git-send-email-asmadeus@codewreck.org
Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/vfs_file.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 03c9e325bfbc..3a2f37ad1f89 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
break;
if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
break;
+ /*
+ * p9_client_lock_dotl overwrites flock.client_id with the
+ * server message, free and reuse the client name
+ */
+ if (flock.client_id != fid->clnt->name) {
+ kfree(flock.client_id);
+ flock.client_id = fid->clnt->name;
+ }
}
/* map 9p status to VFS status */
@@ -235,6 +243,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl)
locks_lock_file_wait(filp, fl);
fl->fl_type = fl_type;
}
+ if (flock.client_id != fid->clnt->name)
+ kfree(flock.client_id);
out:
return res;
}
@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
res = p9_client_getlock_dotl(fid, &glock);
if (res < 0)
- return res;
+ goto out;
/* map 9p lock type to os lock type */
switch (glock.type) {
case P9_LOCK_TYPE_RDLCK:
@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl)
fl->fl_end = glock.start + glock.length - 1;
fl->fl_pid = -glock.proc_id;
}
- kfree(glock.client_id);
+out:
+ if (glock.client_id != fid->clnt->name)
+ kfree(glock.client_id);
return res;
}
--
2.17.1
next prev parent reply other threads:[~2018-11-04 13:59 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-04 13:52 [PATCH AUTOSEL 4.14 01/30] mm/vmstat.c: assert that vmstat_text is in sync with stat_items_size Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.14 02/30] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.14 03/30] mm: don't miss the last page because of round-off error Sasha Levin
2018-11-04 13:52 ` [PATCH AUTOSEL 4.14 04/30] mm: don't warn about large allocations for slab Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 05/30] powerpc/traps: restore recoverability of machine_check interrupts Sasha Levin
2018-11-11 15:50 ` LEROY Christophe
2018-11-11 22:07 ` Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 06/30] powerpc/64/module: REL32 relocation range check Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 07/30] powerpc/mm: Fix page table dump to work on Radix Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 08/30] powerpc/eeh: Fix possible null deref in eeh_dump_dev_log() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 09/30] tty: check name length in tty_find_polling_driver() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 10/30] ARM: imx_v6_v7_defconfig: Select CONFIG_TMPFS_POSIX_ACL Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 11/30] powerpc/nohash: fix undefined behaviour when testing page size support Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 12/30] powerpc/mm: Don't report hugepage tables as memory leaks when using kmemleak Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 13/30] watchdog: lantiq: update register names to better match spec Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 14/30] drm/omap: fix memory barrier bug in DMM driver Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 15/30] iio: adc: at91: fix wrong channel number in triggered buffer mode Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 16/30] iio: adc: at91: fix acking DRDY irq on simple conversions Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 17/30] drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer pointer Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 18/30] media: pci: cx23885: handle adding to list failure Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 19/30] media: coda: don't overwrite h.264 profile_idc on decoder instance Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 20/30] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 21/30] MIPS: kexec: Mark CPU offline before disabling local IRQ Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 22/30] powerpc/boot: Ensure _zimage_start is a weak symbol Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 23/30] powerpc/memtrace: Remove memory in chunks Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 24/30] MIPS/PCI: Call pcie_bus_configure_settings() to set MPS/MRRS Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 25/30] sc16is7xx: Fix for multi-channel stall Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 26/30] media: tvp5150: fix width alignment during set_selection() Sasha Levin
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 27/30] powerpc/selftests: Wait all threads to join Sasha Levin
2018-11-08 22:02 ` Joey Pabalinas
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 28/30] staging:iio:ad7606: fix voltage scales Sasha Levin
2018-11-04 13:53 ` Sasha Levin [this message]
2018-11-04 13:53 ` [PATCH AUTOSEL 4.14 30/30] 9p: clear dangling pointers in p9stat_free Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181104135325.88524-29-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dominique.martinet@cea.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).