[linux] 05/09: block: fix use-after-free in seq file (CVE-2016-7910)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Thu Dec 1 00:23:47 UTC 2016
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch jessie-security
in repository linux.
commit 21e9b279d55b09dd0225eef7c71f16ae6ef165b4
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Wed Nov 30 20:43:35 2016 +0000
block: fix use-after-free in seq file (CVE-2016-7910)
---
debian/changelog | 1 +
.../all/block-fix-use-after-free-in-seq-file.patch | 107 +++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 109 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 5ade7bb..51ed823 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,7 @@ linux (3.16.36-1+deb8u3) UNRELEASED; urgency=medium
procedures
* [powerpc*] KVM: Book3S HV: Save/restore TM state in H_CEDE (CVE-2016-5412)
* posix_acl: Clear SGID bit when setting file permissions (CVE-2016-7097)
+ * block: fix use-after-free in seq file (CVE-2016-7910)
-- Ben Hutchings <ben at decadent.org.uk> Wed, 30 Nov 2016 04:06:41 +0000
diff --git a/debian/patches/bugfix/all/block-fix-use-after-free-in-seq-file.patch b/debian/patches/bugfix/all/block-fix-use-after-free-in-seq-file.patch
new file mode 100644
index 0000000..aa0c85c
--- /dev/null
+++ b/debian/patches/bugfix/all/block-fix-use-after-free-in-seq-file.patch
@@ -0,0 +1,107 @@
+From: Vegard Nossum <vegard.nossum at oracle.com>
+Date: Fri, 29 Jul 2016 10:40:31 +0200
+Subject: block: fix use-after-free in seq file
+Origin: https://git.kernel.org/linus/77da160530dd1dc94f6ae15a981f24e5f0021e84
+
+I got a KASAN report of use-after-free:
+
+ ==================================================================
+ BUG: KASAN: use-after-free in klist_iter_exit+0x61/0x70 at addr ffff8800b6581508
+ Read of size 8 by task trinity-c1/315
+ =============================================================================
+ BUG kmalloc-32 (Not tainted): kasan: bad access detected
+ -----------------------------------------------------------------------------
+
+ Disabling lock debugging due to kernel taint
+ INFO: Allocated in disk_seqf_start+0x66/0x110 age=144 cpu=1 pid=315
+ ___slab_alloc+0x4f1/0x520
+ __slab_alloc.isra.58+0x56/0x80
+ kmem_cache_alloc_trace+0x260/0x2a0
+ disk_seqf_start+0x66/0x110
+ traverse+0x176/0x860
+ seq_read+0x7e3/0x11a0
+ proc_reg_read+0xbc/0x180
+ do_loop_readv_writev+0x134/0x210
+ do_readv_writev+0x565/0x660
+ vfs_readv+0x67/0xa0
+ do_preadv+0x126/0x170
+ SyS_preadv+0xc/0x10
+ do_syscall_64+0x1a1/0x460
+ return_from_SYSCALL_64+0x0/0x6a
+ INFO: Freed in disk_seqf_stop+0x42/0x50 age=160 cpu=1 pid=315
+ __slab_free+0x17a/0x2c0
+ kfree+0x20a/0x220
+ disk_seqf_stop+0x42/0x50
+ traverse+0x3b5/0x860
+ seq_read+0x7e3/0x11a0
+ proc_reg_read+0xbc/0x180
+ do_loop_readv_writev+0x134/0x210
+ do_readv_writev+0x565/0x660
+ vfs_readv+0x67/0xa0
+ do_preadv+0x126/0x170
+ SyS_preadv+0xc/0x10
+ do_syscall_64+0x1a1/0x460
+ return_from_SYSCALL_64+0x0/0x6a
+
+ CPU: 1 PID: 315 Comm: trinity-c1 Tainted: G B 4.7.0+ #62
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+ ffffea0002d96000 ffff880119b9f918 ffffffff81d6ce81 ffff88011a804480
+ ffff8800b6581500 ffff880119b9f948 ffffffff8146c7bd ffff88011a804480
+ ffffea0002d96000 ffff8800b6581500 fffffffffffffff4 ffff880119b9f970
+ Call Trace:
+ [<ffffffff81d6ce81>] dump_stack+0x65/0x84
+ [<ffffffff8146c7bd>] print_trailer+0x10d/0x1a0
+ [<ffffffff814704ff>] object_err+0x2f/0x40
+ [<ffffffff814754d1>] kasan_report_error+0x221/0x520
+ [<ffffffff8147590e>] __asan_report_load8_noabort+0x3e/0x40
+ [<ffffffff83888161>] klist_iter_exit+0x61/0x70
+ [<ffffffff82404389>] class_dev_iter_exit+0x9/0x10
+ [<ffffffff81d2e8ea>] disk_seqf_stop+0x3a/0x50
+ [<ffffffff8151f812>] seq_read+0x4b2/0x11a0
+ [<ffffffff815f8fdc>] proc_reg_read+0xbc/0x180
+ [<ffffffff814b24e4>] do_loop_readv_writev+0x134/0x210
+ [<ffffffff814b4c45>] do_readv_writev+0x565/0x660
+ [<ffffffff814b8a17>] vfs_readv+0x67/0xa0
+ [<ffffffff814b8de6>] do_preadv+0x126/0x170
+ [<ffffffff814b92ec>] SyS_preadv+0xc/0x10
+
+This problem can occur in the following situation:
+
+open()
+ - pread()
+ - .seq_start()
+ - iter = kmalloc() // succeeds
+ - seqf->private = iter
+ - .seq_stop()
+ - kfree(seqf->private)
+ - pread()
+ - .seq_start()
+ - iter = kmalloc() // fails
+ - .seq_stop()
+ - class_dev_iter_exit(seqf->private) // boom! old pointer
+
+As the comment in disk_seqf_stop() says, stop is called even if start
+failed, so we need to reinitialise the private pointer to NULL when seq
+iteration stops.
+
+An alternative would be to set the private pointer to NULL when the
+kmalloc() in disk_seqf_start() fails.
+
+Signed-off-by: Vegard Nossum <vegard.nossum at oracle.com>
+Acked-by: Tejun Heo <tj at kernel.org>
+Signed-off-by: Jens Axboe <axboe at fb.com>
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+ block/genhd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -829,6 +829,7 @@ static void disk_seqf_stop(struct seq_fi
+ if (iter) {
+ class_dev_iter_exit(iter);
+ kfree(iter);
++ seqf->private = NULL;
+ }
+ }
+
diff --git a/debian/patches/series b/debian/patches/series
index bc9dd72..a56f7b1 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -690,6 +690,7 @@ bugfix/arm64/arm64-perf-reject-groups-spanning-multiple-hw-pmus.patch
bugfix/powerpc/kvm-ppc-book3s-hv-pull-out-tm-state-save-restore-into-separate.patch
bugfix/powerpc/kvm-ppc-book3s-hv-save-restore-tm-state-in-h_cede.patch
bugfix/all//posix_acl-clear-sgid-bit-when-setting-file-permissions.patch
+bugfix/all/block-fix-use-after-free-in-seq-file.patch
# Fix ABI changes
debian/of-fix-abi-changes.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list