[linux] 01/01: dentry name snapshots (CVE-2017-7533)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Fri Aug 4 04:27:18 UTC 2017
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to branch carnil/jessie-security/CVE-2017-7533
in repository linux.
commit a56ffb69de38383f26e77b740b9270ee0faf834c
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Fri Jul 28 19:18:04 2017 +0200
dentry name snapshots (CVE-2017-7533)
---
debian/changelog | 1 +
.../patches/bugfix/all/dentry-name-snapshots.patch | 252 +++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 254 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 4326832..f9f4654 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -15,6 +15,7 @@ linux (3.16.43-2+deb8u3) UNRELEASED; urgency=medium
* mqueue: fix a use-after-free in sys_mq_notify() (CVE-2017-11176)
* char: lp: fix possible integer overflow in lp_setup() (CVE-2017-1000363)
* fs/exec.c: account for argv/envp pointers (CVE-2017-1000365)
+ * dentry name snapshots (CVE-2017-7533)
-- Salvatore Bonaccorso <carnil at debian.org> Thu, 27 Jul 2017 22:02:24 +0200
diff --git a/debian/patches/bugfix/all/dentry-name-snapshots.patch b/debian/patches/bugfix/all/dentry-name-snapshots.patch
new file mode 100644
index 0000000..ee08927
--- /dev/null
+++ b/debian/patches/bugfix/all/dentry-name-snapshots.patch
@@ -0,0 +1,252 @@
+From: Al Viro <viro at zeniv.linux.org.uk>
+Date: Fri, 7 Jul 2017 14:51:19 -0400
+Subject: dentry name snapshots
+Origin: https://git.kernel.org/linus/49d31c2f389acfe83417083e1208422b4091cd9e
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7533
+
+take_dentry_name_snapshot() takes a safe snapshot of dentry name;
+if the name is a short one, it gets copied into caller-supplied
+structure, otherwise an extra reference to external name is grabbed
+(those are never modified). In either case the pointer to stable
+string is stored into the same structure.
+
+dentry must be held by the caller of take_dentry_name_snapshot(),
+but may be freely dropped afterwards - the snapshot will stay
+until destroyed by release_dentry_name_snapshot().
+
+Intended use:
+ struct name_snapshot s;
+
+ take_dentry_name_snapshot(&s, dentry);
+ ...
+ access s.name
+ ...
+ release_dentry_name_snapshot(&s);
+
+Replaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name
+to pass down with event.
+
+Signed-off-by: Al Viro <viro at zeniv.linux.org.uk>
+[carnil: backport to 3.16:
+ - adjust context
+ - d_inode(old_dir) -> old_dir->d_inode
+ - d_inode(new_dir) -> new_dir->d_inode
+ - Differences from upstream: 3.16 doesn't have the refcounted external name
+ infrastructure and backporting that would be too invasive. So for external
+ names allocate a buffer and copy the string. All copying is now done under
+ d_lock, so d_name, as well as pointed string is stable. Patch changes are
+ backported from RHEL7.5 patch developed by Miklos Szeredi <mszeredi at redhat.com>
+ and Alexander Gordeev <agordeev at redhat.com>
+]
+---
+ fs/dcache.c | 27 +++++++++++++++++++++++++++
+ fs/debugfs/inode.c | 10 +++++-----
+ fs/namei.c | 8 ++++----
+ fs/notify/fsnotify.c | 8 ++++++--
+ include/linux/dcache.h | 6 ++++++
+ include/linux/fsnotify.h | 31 -------------------------------
+ 6 files changed, 48 insertions(+), 42 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -244,6 +244,47 @@ static void __d_free(struct rcu_head *he
+ kmem_cache_free(dentry_cache, dentry);
+ }
+
++void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry)
++{
++ size_t size = 0;
++ char *buf = NULL;
++
++ if (unlikely(dname_external(dentry))) {
++ size = READ_ONCE(dentry->d_name.len);
++retry:
++ /* Pre allocate buffer */
++ name->name = buf = kmalloc(size + 1, GFP_KERNEL);
++ if (!buf)
++ return;
++ }
++
++ spin_lock(&dentry->d_lock);
++ if (unlikely(dname_external(dentry))) {
++ if (size < dentry->d_name.len) {
++ /* Raced with rename and need to redo the allocation */
++ size = dentry->d_name.len;
++ spin_unlock(&dentry->d_lock);
++ kfree(buf);
++ goto retry;
++ }
++ strcpy(buf, dentry->d_name.name);
++ buf = NULL;
++ } else {
++ memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
++ name->name = name->inline_name;
++ }
++ spin_unlock(&dentry->d_lock);
++ kfree(buf);
++}
++EXPORT_SYMBOL(take_dentry_name_snapshot);
++
++void release_dentry_name_snapshot(struct name_snapshot *name)
++{
++ if (unlikely(name->name != name->inline_name))
++ kfree(name->name);
++}
++EXPORT_SYMBOL(release_dentry_name_snapshot);
++
+ static void dentry_free(struct dentry *dentry)
+ {
+ WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias));
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -620,7 +620,7 @@ struct dentry *debugfs_rename(struct den
+ {
+ int error;
+ struct dentry *dentry = NULL, *trap;
+- const char *old_name;
++ struct name_snapshot old_name;
+
+ trap = lock_rename(new_dir, old_dir);
+ /* Source or destination directories don't exist? */
+@@ -635,19 +635,19 @@ struct dentry *debugfs_rename(struct den
+ if (IS_ERR(dentry) || dentry == trap || dentry->d_inode)
+ goto exit;
+
+- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
++ take_dentry_name_snapshot(&old_name, old_dentry);
+
+ error = simple_rename(old_dir->d_inode, old_dentry, new_dir->d_inode,
+ dentry);
+ if (error) {
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+ goto exit;
+ }
+ d_move(old_dentry, dentry);
+- fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name,
++ fsnotify_move(old_dir->d_inode, new_dir->d_inode, old_name.name,
+ S_ISDIR(old_dentry->d_inode->i_mode),
+ NULL, old_dentry);
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+ unlock_rename(new_dir, old_dir);
+ dput(dentry);
+ return old_dentry;
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -4082,11 +4082,11 @@ int vfs_rename(struct inode *old_dir, st
+ {
+ int error;
+ bool is_dir = d_is_dir(old_dentry);
+- const unsigned char *old_name;
+ struct inode *source = old_dentry->d_inode;
+ struct inode *target = new_dentry->d_inode;
+ bool new_is_dir = false;
+ unsigned max_links = new_dir->i_sb->s_max_links;
++ struct name_snapshot old_name;
+
+ if (source == target)
+ return 0;
+@@ -4136,7 +4136,7 @@ int vfs_rename(struct inode *old_dir, st
+ if (error)
+ return error;
+
+- old_name = fsnotify_oldname_init(old_dentry->d_name.name);
++ take_dentry_name_snapshot(&old_name, old_dentry);
+ dget(new_dentry);
+ if (!is_dir || (flags & RENAME_EXCHANGE))
+ lock_two_nondirectories(source, target);
+@@ -4195,14 +4195,14 @@ out:
+ mutex_unlock(&target->i_mutex);
+ dput(new_dentry);
+ if (!error) {
+- fsnotify_move(old_dir, new_dir, old_name, is_dir,
++ fsnotify_move(old_dir, new_dir, old_name.name, is_dir,
+ !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry);
+ if (flags & RENAME_EXCHANGE) {
+ fsnotify_move(new_dir, old_dir, old_dentry->d_name.name,
+ new_is_dir, NULL, new_dentry);
+ }
+ }
+- fsnotify_oldname_free(old_name);
++ release_dentry_name_snapshot(&old_name);
+
+ return error;
+ }
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -105,16 +105,20 @@ int __fsnotify_parent(struct path *path,
+ if (unlikely(!fsnotify_inode_watches_children(p_inode)))
+ __fsnotify_update_child_dentry_flags(p_inode);
+ else if (p_inode->i_fsnotify_mask & mask) {
++ struct name_snapshot name;
++
+ /* we are notifying a parent so come up with the new mask which
+ * specifies these are events which came from a child. */
+ mask |= FS_EVENT_ON_CHILD;
+
++ take_dentry_name_snapshot(&name, dentry);
+ if (path)
+ ret = fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH,
+- dentry->d_name.name, 0);
++ name.name, 0);
+ else
+ ret = fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE,
+- dentry->d_name.name, 0);
++ name.name, 0);
++ release_dentry_name_snapshot(&name);
+ }
+
+ dput(parent);
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -530,4 +530,11 @@ static inline struct dentry *d_backing_d
+ return upper;
+ }
+
++struct name_snapshot {
++ const char *name;
++ char inline_name[DNAME_INLINE_LEN];
++};
++void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *);
++void release_dentry_name_snapshot(struct name_snapshot *);
++
+ #endif /* __LINUX_DCACHE_H */
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -310,35 +310,4 @@ static inline void fsnotify_change(struc
+ }
+ }
+
+-#if defined(CONFIG_FSNOTIFY) /* notify helpers */
+-
+-/*
+- * fsnotify_oldname_init - save off the old filename before we change it
+- */
+-static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name)
+-{
+- return kstrdup(name, GFP_KERNEL);
+-}
+-
+-/*
+- * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init
+- */
+-static inline void fsnotify_oldname_free(const unsigned char *old_name)
+-{
+- kfree(old_name);
+-}
+-
+-#else /* CONFIG_FSNOTIFY */
+-
+-static inline const char *fsnotify_oldname_init(const unsigned char *name)
+-{
+- return NULL;
+-}
+-
+-static inline void fsnotify_oldname_free(const unsigned char *old_name)
+-{
+-}
+-
+-#endif /* CONFIG_FSNOTIFY */
+-
+ #endif /* _LINUX_FS_NOTIFY_H */
diff --git a/debian/patches/series b/debian/patches/series
index e180cc7..2759b04 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -723,6 +723,7 @@ bugfix/all/xen-blkback-don-t-leak-stack-data-via-response-ring.patch
bugfix/all/mqueue-fix-a-use-after-free-in-sys_mq_notify.patch
bugfix/all/char-lp-fix-possible-integer-overflow-in-lp_setup.patch
bugfix/all/fs-exec.c-account-for-argv-envp-pointers.patch
+bugfix/all/dentry-name-snapshots.patch
# Fix ABI changes
debian/of-fix-abi-changes.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list