From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Mike Rapoport <rppt@linux.ibm.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Daniel Colascione <dancol@google.com>,
Jann Horn <jannh@google.com>,
Lokesh Gidra <lokeshgidra@google.com>,
Nick Kralevich <nnk@google.com>, Nosh Minwalla <nosh@google.com>,
Pavel Emelyanov <ovzxemul@gmail.com>,
Tim Murray <timmurray@google.com>,
Aleksa Sarai <cyphar@cyphar.com>,
Andrew Morton <akpm@linux-foundation.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Sasha Levin <sashal@kernel.org>,
linux-fsdevel@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 58/58] userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
Date: Wed, 11 Dec 2019 10:28:31 -0500 [thread overview]
Message-ID: <20191211152831.23507-58-sashal@kernel.org> (raw)
In-Reply-To: <20191211152831.23507-1-sashal@kernel.org>
From: Mike Rapoport <rppt@linux.ibm.com>
[ Upstream commit 3c1c24d91ffd536de0a64688a9df7f49e58fadbc ]
A while ago Andy noticed
(http://lkml.kernel.org/r/CALCETrWY+5ynDct7eU_nDUqx=okQvjm=Y5wJvA4ahBja=CQXGw@mail.gmail.com)
that UFFD_FEATURE_EVENT_FORK used by an unprivileged user may have
security implications.
As the first step of the solution the following patch limits the availably
of UFFD_FEATURE_EVENT_FORK only for those having CAP_SYS_PTRACE.
The usage of CAP_SYS_PTRACE ensures compatibility with CRIU.
Yet, if there are other users of non-cooperative userfaultfd that run
without CAP_SYS_PTRACE, they would be broken :(
Current implementation of UFFD_FEATURE_EVENT_FORK modifies the file
descriptor table from the read() implementation of uffd, which may have
security implications for unprivileged use of the userfaultfd.
Limit availability of UFFD_FEATURE_EVENT_FORK only for callers that have
CAP_SYS_PTRACE.
Link: http://lkml.kernel.org/r/1572967777-8812-2-git-send-email-rppt@linux.ibm.com
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Daniel Colascione <dancol@google.com>
Cc: Jann Horn <jannh@google.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Nick Kralevich <nnk@google.com>
Cc: Nosh Minwalla <nosh@google.com>
Cc: Pavel Emelyanov <ovzxemul@gmail.com>
Cc: Tim Murray <timmurray@google.com>
Cc: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/userfaultfd.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index a609d480606da..e2b2196fd9428 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1807,13 +1807,12 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
if (copy_from_user(&uffdio_api, buf, sizeof(uffdio_api)))
goto out;
features = uffdio_api.features;
- if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES)) {
- memset(&uffdio_api, 0, sizeof(uffdio_api));
- if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
- goto out;
- ret = -EINVAL;
- goto out;
- }
+ ret = -EINVAL;
+ if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))
+ goto err_out;
+ ret = -EPERM;
+ if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))
+ goto err_out;
/* report all available features and ioctls to userland */
uffdio_api.features = UFFD_API_FEATURES;
uffdio_api.ioctls = UFFD_API_IOCTLS;
@@ -1826,6 +1825,11 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx,
ret = 0;
out:
return ret;
+err_out:
+ memset(&uffdio_api, 0, sizeof(uffdio_api));
+ if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
+ ret = -EFAULT;
+ goto out;
}
static long userfaultfd_ioctl(struct file *file, unsigned cmd,
--
2.20.1
prev parent reply other threads:[~2019-12-11 15:29 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-11 15:27 [PATCH AUTOSEL 4.14 01/58] scsi: lpfc: Fix discovery failures when target device connectivity bounces Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 02/58] scsi: mpt3sas: Fix clear pending bit in ioctl status Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 03/58] scsi: lpfc: Fix locking on mailbox command completion Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 04/58] Input: atmel_mxt_ts - disable IRQ across suspend Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 05/58] iommu/tegra-smmu: Fix page tables in > 4 GiB memory Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 06/58] scsi: target: compare full CHAP_A Algorithm strings Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 07/58] scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 08/58] scsi: csiostor: Don't enable IRQs too early Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 09/58] powerpc/pseries: Mark accumulate_stolen_time() as notrace Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 10/58] powerpc/pseries: Don't fail hash page table insert for bolted mapping Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 11/58] powerpc/tools: Don't quote $objdump in scripts Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 12/58] dma-debug: add a schedule point in debug_dma_dump_mappings() Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 13/58] clocksource/drivers/asm9260: Add a check for of_clk_get Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 14/58] powerpc/security/book3s64: Report L1TF status in sysfs Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 15/58] powerpc/book3s64/hash: Add cond_resched to avoid soft lockup warning Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 16/58] ext4: update direct I/O read lock pattern for IOCB_NOWAIT Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 17/58] jbd2: Fix statistics for the number of logged blocks Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 18/58] scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6) Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 19/58] scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 20/58] f2fs: fix to update dir's i_pino during cross_rename Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 21/58] clk: qcom: Allow constant ratio freq tables for rcg Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 22/58] irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 23/58] irqchip: ingenic: Error out if IRQ domain creation failed Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 24/58] mfd: mfd-core: Honour Device Tree's request to disable a child-device Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 25/58] fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long Sasha Levin
2019-12-11 15:27 ` [PATCH AUTOSEL 4.14 26/58] scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 27/58] scsi: ufs: fix potential bug which ends in system hang Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 28/58] powerpc/pseries/cmm: Implement release() function for sysfs device Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 29/58] powerpc/security: Fix wrong message when RFI Flush is disable Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 30/58] scsi: atari_scsi: sun3_scsi: Set sg_tablesize to 1 instead of SG_NONE Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 31/58] clk: pxa: fix one of the pxa RTC clocks Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 32/58] bcache: at least try to shrink 1 node in bch_mca_scan() Sasha Levin
2019-12-12 3:48 ` John Stoffel
2019-12-12 3:52 ` Coly Li
2019-12-12 4:00 ` John Stoffel
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 33/58] ext4: fix a bug in ext4_wait_for_tail_page_commit Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 34/58] HID: logitech-hidpp: Silence intermittent get_battery_capacity errors Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 35/58] libnvdimm/btt: fix variable 'rc' set but not used Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 36/58] HID: Improve Windows Precision Touchpad detection Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 37/58] watchdog: aspeed: Fix clock behaviour for ast2600 Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 38/58] ext4: work around deleting a file with i_nlink == 0 safely Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 39/58] scsi: pm80xx: Fix for SATA device discovery Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 40/58] scsi: ufs: Fix error handing during hibern8 enter Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 41/58] scsi: scsi_debug: num_tgts must be >= 0 Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 42/58] scsi: NCR5380: Add disconnect_mask module parameter Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 43/58] scsi: iscsi: Don't send data to unbound connection Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 44/58] scsi: target: iscsi: Wait for all commands to finish before freeing a session Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 45/58] gpio: mpc8xxx: Don't overwrite default irq_set_type callback Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 46/58] apparmor: fix unsigned len comparison with less than zero Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 47/58] scripts/kallsyms: fix definitely-lost memory leak Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 48/58] f2fs: choose hardlimit when softlimit is larger than hardlimit in f2fs_statfs_project() Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 49/58] of: unittest: fix memory leak in attach_node_and_children Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 50/58] cdrom: respect device capabilities during opening action Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 51/58] perf script: Fix brstackinsn for AUXTRACE Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 52/58] perf regs: Make perf_reg_name() return "unknown" instead of NULL Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 53/58] s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 54/58] libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 55/58] s390/cpum_sf: Check for SDBT and SDB consistency Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 56/58] ocfs2: fix passing zero to 'PTR_ERR' warning Sasha Levin
2019-12-11 15:28 ` [PATCH AUTOSEL 4.14 57/58] kernel: sysctl: make drop_caches write-only Sasha Levin
2019-12-11 15:28 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191211152831.23507-58-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=cyphar@cyphar.com \
--cc=dancol@google.com \
--cc=jannh@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lokeshgidra@google.com \
--cc=nnk@google.com \
--cc=nosh@google.com \
--cc=ovzxemul@gmail.com \
--cc=rppt@linux.ibm.com \
--cc=stable@vger.kernel.org \
--cc=timmurray@google.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).