[kernel] r14542 - in dists/lenny-security/linux-2.6/debian: . patches/bugfix/all patches/series
Dann Frazier
dannf at alioth.debian.org
Wed Nov 4 16:29:34 UTC 2009
Author: dannf
Date: Wed Nov 4 16:29:33 2009
New Revision: 14542
Log:
fs: pipe.c null pointer dereference (CVE-2009-3547)
Added:
dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fs-pipe-null-pointer-dereference.patch
Modified:
dists/lenny-security/linux-2.6/debian/changelog
dists/lenny-security/linux-2.6/debian/patches/series/19lenny2
Modified: dists/lenny-security/linux-2.6/debian/changelog
==============================================================================
--- dists/lenny-security/linux-2.6/debian/changelog Wed Nov 4 02:02:19 2009 (r14541)
+++ dists/lenny-security/linux-2.6/debian/changelog Wed Nov 4 16:29:33 2009 (r14542)
@@ -6,6 +6,7 @@
* drm/r128: Add test for initialisation to all ioctls that require it
(CVE-2009-3620)
* AF_UNIX: Fix deadlock on connecting to shutdown socket (CVE-2009-3621)
+ * fs: pipe.c null pointer dereference (CVE-2009-3547)
-- dann frazier <dannf at debian.org> Tue, 27 Oct 2009 21:33:02 -0600
Added: dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fs-pipe-null-pointer-dereference.patch
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/lenny-security/linux-2.6/debian/patches/bugfix/all/fs-pipe-null-pointer-dereference.patch Wed Nov 4 16:29:33 2009 (r14542)
@@ -0,0 +1,130 @@
+commit ad3960243e55320d74195fb85c975e0a8cc4466c
+Author: Earl Chew <earl_chew at agilent.com>
+Date: Mon Oct 19 15:55:41 2009 -0700
+
+ fs: pipe.c null pointer dereference
+
+ This patch fixes a null pointer exception in pipe_rdwr_open() which
+ generates the stack trace:
+
+ > Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP:
+ > [<ffffffff802899a5>] pipe_rdwr_open+0x35/0x70
+ > [<ffffffff8028125c>] __dentry_open+0x13c/0x230
+ > [<ffffffff8028143d>] do_filp_open+0x2d/0x40
+ > [<ffffffff802814aa>] do_sys_open+0x5a/0x100
+ > [<ffffffff8021faf3>] sysenter_do_call+0x1b/0x67
+
+ The failure mode is triggered by an attempt to open an anonymous
+ pipe via /proc/pid/fd/* as exemplified by this script:
+
+ =============================================================
+ while : ; do
+ { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
+ PID=$!
+ OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
+ { read PID REST ; echo $PID; } )
+ OUT="${OUT%% *}"
+ DELAY=$((RANDOM * 1000 / 32768))
+ usleep $((DELAY * 1000 + RANDOM % 1000 ))
+ echo n > /proc/$OUT/fd/1 # Trigger defect
+ done
+ =============================================================
+
+ Note that the failure window is quite small and I could only
+ reliably reproduce the defect by inserting a small delay
+ in pipe_rdwr_open(). For example:
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ msleep(100);
+ mutex_lock(&inode->i_mutex);
+
+ Although the defect was observed in pipe_rdwr_open(), I think it
+ makes sense to replicate the change through all the pipe_*_open()
+ functions.
+
+ The core of the change is to verify that inode->i_pipe has not
+ been released before attempting to manipulate it. If inode->i_pipe
+ is no longer present, return ENOENT to indicate so.
+
+ The comment about potentially using atomic_t for i_pipe->readers
+ and i_pipe->writers has also been removed because it is no longer
+ relevant in this context. The inode->i_mutex lock must be used so
+ that inode->i_pipe can be dealt with correctly.
+
+ Signed-off-by: Earl Chew <earl_chew at agilent.com>
+ Cc: stable at kernel.org
+ Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 52c4151..ae17d02 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, struct file *filp)
+ static int
+ pipe_read_open(struct inode *inode, struct file *filp)
+ {
+- /* We could have perhaps used atomic_t, but this and friends
+- below are the only places. So it doesn't seem worthwhile. */
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->readers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->readers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_write_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- if (filp->f_mode & FMODE_READ)
+- inode->i_pipe->readers++;
+- if (filp->f_mode & FMODE_WRITE)
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ if (filp->f_mode & FMODE_READ)
++ inode->i_pipe->readers++;
++ if (filp->f_mode & FMODE_WRITE)
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ /*
Modified: dists/lenny-security/linux-2.6/debian/patches/series/19lenny2
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/series/19lenny2 Wed Nov 4 02:02:19 2009 (r14541)
+++ dists/lenny-security/linux-2.6/debian/patches/series/19lenny2 Wed Nov 4 16:29:33 2009 (r14542)
@@ -3,3 +3,4 @@
+ bugfix/all/netlink-fix-typo-in-initialization.patch
+ bugfix/all/drm+r128-Add-test-for-init-to-all-reqd-ioctls.patch
+ bugfix/all/af_unix-fix-deadlock-on-connecting-to-shutdown-socket.patch
++ bugfix/all/fs-pipe-null-pointer-dereference.patch
More information about the Kernel-svn-changes
mailing list