[linux] 03/04: xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present (CVE-2017-14340)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch sid
in repository linux.

commit 8f075a9a8370142317c04970a1d5ff46f5b8e8e6
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu Sep 14 06:40:30 2017 +0200

    xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present (CVE-2017-14340)
---
 debian/changelog                                   |  2 +
 ...REALTIME_INODE-should-be-false-if-no-rt-d.patch | 72 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 75 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index c65dce7..a33f7e2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,8 @@ linux (4.12.12-3) UNRELEASED; urgency=medium
 
   * sctp: Avoid out-of-bounds reads from address storage (CVE-2017-7558)
   * scsi: qla2xxx: Fix an integer overflow in sysfs code (CVE-2017-14051)
+  * xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
+    (CVE-2017-14340)
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Thu, 14 Sep 2017 06:25:04 +0200
 
diff --git a/debian/patches/bugfix/all/xfs-XFS_IS_REALTIME_INODE-should-be-false-if-no-rt-d.patch b/debian/patches/bugfix/all/xfs-XFS_IS_REALTIME_INODE-should-be-false-if-no-rt-d.patch
new file mode 100644
index 0000000..8afebec
--- /dev/null
+++ b/debian/patches/bugfix/all/xfs-XFS_IS_REALTIME_INODE-should-be-false-if-no-rt-d.patch
@@ -0,0 +1,72 @@
+From: Richard Wareing <rwareing at fb.com>
+Date: Wed, 13 Sep 2017 09:09:35 +1000
+Subject: xfs: XFS_IS_REALTIME_INODE() should be false if no rt device present
+Origin: https://git.kernel.org/linus/b31ff3cdf540110da4572e3e29bd172087af65cc
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-14340
+
+If using a kernel with CONFIG_XFS_RT=y and we set the RHINHERIT flag on
+a directory in a filesystem that does not have a realtime device and
+create a new file in that directory, it gets marked as a real time file.
+When data is written and a fsync is issued, the filesystem attempts to
+flush a non-existent rt device during the fsync process.
+
+This results in a crash dereferencing a null buftarg pointer in
+xfs_blkdev_issue_flush():
+
+  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
+  IP: xfs_blkdev_issue_flush+0xd/0x20
+  .....
+  Call Trace:
+    xfs_file_fsync+0x188/0x1c0
+    vfs_fsync_range+0x3b/0xa0
+    do_fsync+0x3d/0x70
+    SyS_fsync+0x10/0x20
+    do_syscall_64+0x4d/0xb0
+    entry_SYSCALL64_slow_path+0x25/0x25
+
+Setting RT inode flags does not require special privileges so any
+unprivileged user can cause this oops to occur.  To reproduce, confirm
+kernel is compiled with CONFIG_XFS_RT=y and run:
+
+  # mkfs.xfs -f /dev/pmem0
+  # mount /dev/pmem0 /mnt/test
+  # mkdir /mnt/test/foo
+  # xfs_io -c 'chattr +t' /mnt/test/foo
+  # xfs_io -f -c 'pwrite 0 5m' -c fsync /mnt/test/foo/bar
+
+Or just run xfstests with MKFS_OPTIONS="-d rtinherit=1" and wait.
+
+Kernels built with CONFIG_XFS_RT=n are not exposed to this bug.
+
+Fixes: f538d4da8d52 ("[XFS] write barrier support")
+Cc: <stable at vger.kernel.org>
+Signed-off-by: Richard Wareing <rwareing at fb.com>
+Signed-off-by: Dave Chinner <david at fromorbit.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ fs/xfs/xfs_linux.h | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
+index 9301c5a6060b..dcd1292664b3 100644
+--- a/fs/xfs/xfs_linux.h
++++ b/fs/xfs/xfs_linux.h
+@@ -270,7 +270,14 @@ static inline uint64_t howmany_64(uint64_t x, uint32_t y)
+ #endif /* DEBUG */
+ 
+ #ifdef CONFIG_XFS_RT
+-#define XFS_IS_REALTIME_INODE(ip) ((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME)
++
++/*
++ * make sure we ignore the inode flag if the filesystem doesn't have a
++ * configured realtime device.
++ */
++#define XFS_IS_REALTIME_INODE(ip)			\
++	(((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME) &&	\
++	 (ip)->i_mount->m_rtdev_targp)
+ #else
+ #define XFS_IS_REALTIME_INODE(ip) (0)
+ #endif
+-- 
+2.11.0
+
diff --git a/debian/patches/series b/debian/patches/series
index 957d7d9..2f35f1f 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -122,6 +122,7 @@ features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch
 debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 bugfix/all/sctp-Avoid-out-of-bounds-reads-from-address-storage.patch
 bugfix/all/scsi-qla2xxx-Fix-an-integer-overflow-in-sysfs-code.patch
+bugfix/all/xfs-XFS_IS_REALTIME_INODE-should-be-false-if-no-rt-d.patch
 
 # Fix exported symbol versions
 bugfix/alpha/alpha-restore-symbol-versions-for-symbols-exported-f.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git