From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08524C2F3A0 for ; Mon, 21 Jan 2019 14:04:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CC5032089F for ; Mon, 21 Jan 2019 14:04:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548079480; bh=/yr1c7rMVvQB+7T6SBLFyVAMjdDJpnheNJoB8yeOFf0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=XbPtLOqCn6iF4yrg6R3xMn/MMJfgpZZiI3rPDQdyNrwzwUuNaU3hIhlgVkVDA/FFh 9x01L7sZDE1xHrf0uuJ3O0jEfnqpGcyqTavwK4z6PyGkQzupw/IkFYgqSCNOK0gW5u q7RoUfp3yZZKMRHVjBzgOIvesvqIW4/63izYrWd8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732707AbfAUOBz (ORCPT ); Mon, 21 Jan 2019 09:01:55 -0500 Received: from mail.kernel.org ([198.145.29.99]:48974 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732691AbfAUOBt (ORCPT ); Mon, 21 Jan 2019 09:01:49 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A4ABD2089F; Mon, 21 Jan 2019 14:01:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1548079308; bh=/yr1c7rMVvQB+7T6SBLFyVAMjdDJpnheNJoB8yeOFf0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rVtx4E3tbGWk+f9l45dnK9JPB5O/NUfbnDpWGUP/PVNJTr3q3iDsS5QpDtzsJePcA vknzu5hSt/yeQiKvZG3zqAQoHD59X6vzpvunwrlFzjJniWc5vmdkawJRKBcN924Ku0 WzQkOmwJokxbA7gajk8fY5JOkD8MGej/M0aOd6Mk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com, Oleg Nesterov , Kees Cook , James Morris Subject: [PATCH 4.19 42/99] Yama: Check for pid death before checking ancestry Date: Mon, 21 Jan 2019 14:48:34 +0100 Message-Id: <20190121134915.566276547@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190121134913.924726465@linuxfoundation.org> References: <20190121134913.924726465@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kees Cook commit 9474f4e7cd71a633fa1ef93b7daefd44bbdfd482 upstream. It's possible that a pid has died before we take the rcu lock, in which case we can't walk the ancestry list as it may be detached. Instead, check for death first before doing the walk. Reported-by: syzbot+a9ac39bf55329e206219@syzkaller.appspotmail.com Fixes: 2d514487faf1 ("security: Yama LSM") Cc: stable@vger.kernel.org Suggested-by: Oleg Nesterov Signed-off-by: Kees Cook Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman --- security/yama/yama_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -368,7 +368,9 @@ static int yama_ptrace_access_check(stru break; case YAMA_SCOPE_RELATIONAL: rcu_read_lock(); - if (!task_is_descendant(current, child) && + if (!pid_alive(child)) + rc = -EPERM; + if (!rc && !task_is_descendant(current, child) && !ptracer_exception_found(current, child) && !ns_capable(__task_cred(child)->user_ns, CAP_SYS_PTRACE)) rc = -EPERM;