[linux] 01/01: Stack overflow via ecryptfs and /proc/$pid/environ (CVE-2016-1583)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sat Jun 11 05:12:53 UTC 2016
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to branch sid
in repository linux.
commit 91d6f22ed84a97960ebad7e0cd1b3658e7494cbf
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Sat Jun 11 07:06:31 2016 +0200
Stack overflow via ecryptfs and /proc/$pid/environ (CVE-2016-1583)
proc: prevent stacking filesystems on top
ecryptfs: forbid opening files without mmap handler
sched: panic on corrupted stack end
---
debian/changelog | 6 +++
...forbid-opening-files-without-mmap-handler.patch | 59 ++++++++++++++++++++++
.../proc-prevent-stacking-filesystems-on-top.patch | 41 +++++++++++++++
.../all/sched-panic-on-corrupted-stack-end.patch | 36 +++++++++++++
debian/patches/series | 3 ++
5 files changed, 145 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 6e2a390..68cef9a 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -117,6 +117,12 @@ linux (4.6.2-1) UNRELEASED; urgency=medium
[ Ben Hutchings ]
* [armel,armhf,sh4] linux-image: Do not suggest fdutils
+ [ Salvatore Bonaccorso ]
+ * Stack overflow via ecryptfs and /proc/$pid/environ (CVE-2016-1583)
+ - proc: prevent stacking filesystems on top
+ - ecryptfs: forbid opening files without mmap handler
+ - sched: panic on corrupted stack end
+
-- Ben Hutchings <ben at decadent.org.uk> Thu, 09 Jun 2016 02:56:01 +0100
linux (4.6.1-1) unstable; urgency=medium
diff --git a/debian/patches/bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch b/debian/patches/bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
new file mode 100644
index 0000000..e4167de
--- /dev/null
+++ b/debian/patches/bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
@@ -0,0 +1,59 @@
+From: Jann Horn <jannh at google.com>
+Date: Wed, 1 Jun 2016 11:55:06 +0200
+Subject: [2/3] ecryptfs: forbid opening files without mmap handler
+Origin: https://git.kernel.org/linus/2f36db71009304b3f0b95afacd8eba1f9f046b87
+
+This prevents users from triggering a stack overflow through a recursive
+invocation of pagefault handling that involves mapping procfs files into
+virtual memory.
+
+Signed-off-by: Jann Horn <jannh at google.com>
+Acked-by: Tyler Hicks <tyhicks at canonical.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ fs/ecryptfs/kthread.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
+index 866bb18..e818f5a 100644
+--- a/fs/ecryptfs/kthread.c
++++ b/fs/ecryptfs/kthread.c
+@@ -25,6 +25,7 @@
+ #include <linux/slab.h>
+ #include <linux/wait.h>
+ #include <linux/mount.h>
++#include <linux/file.h>
+ #include "ecryptfs_kernel.h"
+
+ struct ecryptfs_open_req {
+@@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
+ (*lower_file) = dentry_open(&req.path, flags, cred);
+ if (!IS_ERR(*lower_file))
+- goto out;
++ goto have_file;
+ if ((flags & O_ACCMODE) == O_RDONLY) {
+ rc = PTR_ERR((*lower_file));
+ goto out;
+@@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file **lower_file,
+ mutex_unlock(&ecryptfs_kthread_ctl.mux);
+ wake_up(&ecryptfs_kthread_ctl.wait);
+ wait_for_completion(&req.done);
+- if (IS_ERR(*lower_file))
++ if (IS_ERR(*lower_file)) {
+ rc = PTR_ERR(*lower_file);
++ goto out;
++ }
++have_file:
++ if ((*lower_file)->f_op->mmap == NULL) {
++ fput(*lower_file);
++ *lower_file = NULL;
++ rc = -EMEDIUMTYPE;
++ }
+ out:
+ return rc;
+ }
+--
+2.8.1
+
diff --git a/debian/patches/bugfix/all/proc-prevent-stacking-filesystems-on-top.patch b/debian/patches/bugfix/all/proc-prevent-stacking-filesystems-on-top.patch
new file mode 100644
index 0000000..fb2e969
--- /dev/null
+++ b/debian/patches/bugfix/all/proc-prevent-stacking-filesystems-on-top.patch
@@ -0,0 +1,41 @@
+From: Jann Horn <jannh at google.com>
+Date: Wed, 1 Jun 2016 11:55:05 +0200
+Subject: [1/3] proc: prevent stacking filesystems on top
+Origin: https://git.kernel.org/linus/e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9
+
+This prevents stacking filesystems (ecryptfs and overlayfs) from using
+procfs as lower filesystem. There is too much magic going on inside
+procfs, and there is no good reason to stack stuff on top of procfs.
+
+(For example, procfs does access checks in VFS open handlers, and
+ecryptfs by design calls open handlers from a kernel thread that doesn't
+drop privileges or so.)
+
+Signed-off-by: Jann Horn <jannh at google.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ fs/proc/root.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/proc/root.c b/fs/proc/root.c
+index 361ab4e..ec649c9 100644
+--- a/fs/proc/root.c
++++ b/fs/proc/root.c
+@@ -121,6 +121,13 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
+ if (IS_ERR(sb))
+ return ERR_CAST(sb);
+
++ /*
++ * procfs isn't actually a stacking filesystem; however, there is
++ * too much magic going on inside it to permit stacking things on
++ * top of it
++ */
++ sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
++
+ if (!proc_parse_options(options, ns)) {
+ deactivate_locked_super(sb);
+ return ERR_PTR(-EINVAL);
+--
+2.8.1
+
diff --git a/debian/patches/bugfix/all/sched-panic-on-corrupted-stack-end.patch b/debian/patches/bugfix/all/sched-panic-on-corrupted-stack-end.patch
new file mode 100644
index 0000000..170e944
--- /dev/null
+++ b/debian/patches/bugfix/all/sched-panic-on-corrupted-stack-end.patch
@@ -0,0 +1,36 @@
+From: Jann Horn <jannh at google.com>
+Date: Wed, 1 Jun 2016 11:55:07 +0200
+Subject: [3/3] sched: panic on corrupted stack end
+Origin: https://git.kernel.org/linus/29d6455178a09e1dc340380c582b13356227e8df
+
+Until now, hitting this BUG_ON caused a recursive oops (because oops
+handling involves do_exit(), which calls into the scheduler, which in
+turn raises an oops), which caused stuff below the stack to be
+overwritten until a panic happened (e.g. via an oops in interrupt
+context, caused by the overwritten CPU index in the thread_info).
+
+Just panic directly.
+
+Signed-off-by: Jann Horn <jannh at google.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ kernel/sched/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index d1f7149..11546a6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -3047,7 +3047,8 @@ static noinline void __schedule_bug(struct task_struct *prev)
+ static inline void schedule_debug(struct task_struct *prev)
+ {
+ #ifdef CONFIG_SCHED_STACK_END_CHECK
+- BUG_ON(task_stack_end_corrupted(prev));
++ if (task_stack_end_corrupted(prev))
++ panic("corrupted stack end detected inside scheduler\n");
+ #endif
+
+ if (unlikely(in_atomic_preempt_off())) {
+--
+2.8.1
+
diff --git a/debian/patches/series b/debian/patches/series
index fdfc420..41252ef 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -107,6 +107,9 @@ bugfix/all/usb-usbfs-fix-potential-infoleak-in-devio.patch
bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch
bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_cca.patch
bugfix/all/alsa-timer-fix-leak-in-events-via-snd_timer_user_tin.patch
+bugfix/all/proc-prevent-stacking-filesystems-on-top.patch
+bugfix/all/ecryptfs-forbid-opening-files-without-mmap-handler.patch
+bugfix/all/sched-panic-on-corrupted-stack-end.patch
# Tools bug fixes
bugfix/all/usbip-document-tcp-wrappers.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list