From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752942AbbG1SYY (ORCPT ); Tue, 28 Jul 2015 14:24:24 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:47178 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751998AbbG1SYV (ORCPT ); Tue, 28 Jul 2015 14:24:21 -0400 From: ebiederm@xmission.com (Eric W. Biederman) To: Kees Cook Cc: Oleg Nesterov , David Howells , linux-kernel@vger.kernel.org, Andrew Morton , Peter Zijlstra , Ingo Molnar , "Kirill A. Shutemov" , Rik van Riel , Vladimir Davydov , Ricky Zhou , Julien Tinnes References: <20150728171500.GA2871@www.outflux.net> Date: Tue, 28 Jul 2015 13:17:40 -0500 In-Reply-To: <20150728171500.GA2871@www.outflux.net> (Kees Cook's message of "Tue, 28 Jul 2015 10:15:00 -0700") Message-ID: <87d1zcm9iz.fsf@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-XM-AID: U2FsdGVkX1/dIzaBBMqSrCk7nL35633LYk4yvtthINE= X-SA-Exim-Connect-IP: 97.119.22.40 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.7 XMSubLong Long Subject * 0.0 TVD_RCVD_IP Message was received from an IP address * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa04 1397; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: XMission; sa04 1397; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: ;Kees Cook X-Spam-Relay-Country: X-Spam-Timing: total 586 ms - load_scoreonly_sql: 2.1 (0.4%), signal_user_changed: 6 (1.1%), b_tie_ro: 4.3 (0.7%), parse: 1.74 (0.3%), extract_message_metadata: 16 (2.7%), get_uri_detail_list: 3.3 (0.6%), tests_pri_-1000: 7 (1.1%), tests_pri_-950: 1.26 (0.2%), tests_pri_-900: 1.02 (0.2%), tests_pri_-400: 26 (4.4%), check_bayes: 25 (4.2%), b_tokenize: 8 (1.3%), b_tok_get_all: 8 (1.3%), b_comp_prob: 2.4 (0.4%), b_tok_touch_all: 4.8 (0.8%), b_finish: 0.74 (0.1%), tests_pri_0: 513 (87.5%), tests_pri_500: 7 (1.3%), rewrite_mail: 0.00 (0.0%) Subject: Re: [PATCH] user_ns: use correct check for single-threadedness X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Wed, 24 Sep 2014 11:00:52 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Kees Cook writes: > From: Ricky Zhou > > Checking mm_users > 1 does not mean a process is multithreaded. For > example, reading /proc/PID/maps temporarily increments mm_users, allowing > other processes to (accidentally) interfere with unshare() calls. > > This fixes observed failures of unshare(CLONE_NEWUSER) incorrectly > returning EINVAL if another processes happened to be simultaneously > reading the maps file. > > Signed-off-by: Ricky Zhou > Signed-off-by: Kees Cook > Cc: stable@vger.kernel.org This looks like a good fix. Any chance you can drudge up the commit where this hack came in so that Greg & Company know how far to back port this? > --- > kernel/fork.c | 4 ++-- > kernel/user_namespace.c | 3 ++- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/kernel/fork.c b/kernel/fork.c > index dbd9b8d7b7cc..7d138f152dcd 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -75,6 +75,7 @@ > #include > #include > #include > +#include > > #include > #include > @@ -1876,8 +1877,7 @@ static int check_unshare_flags(unsigned long unshare_flags) > * needs to unshare vm. > */ > if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) { > - /* FIXME: get_task_mm() increments ->mm_users */ > - if (atomic_read(¤t->mm->mm_users) > 1) > + if (!current_is_single_threaded()) > return -EINVAL; > } > > diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c > index 4109f8320684..7e0e021e4304 100644 > --- a/kernel/user_namespace.c > +++ b/kernel/user_namespace.c > @@ -22,6 +22,7 @@ > #include > #include > #include > +#include > > static struct kmem_cache *user_ns_cachep __read_mostly; > static DEFINE_MUTEX(userns_state_mutex); > @@ -977,7 +978,7 @@ static int userns_install(struct nsproxy *nsproxy, struct ns_common *ns) > return -EINVAL; > > /* Threaded processes may not enter a different user namespace */ > - if (atomic_read(¤t->mm->mm_users) > 1) > + if (!current_is_single_threaded()) > return -EINVAL; > > if (current->fs->users != 1) > -- > 1.9.1