CVE-2013-1767 tmpfs: fix use-after-free of mempolicy obj (rhbz 915592,915716)
This commit is contained in:
parent
66df908ad4
commit
1f1cbe4b73
|
@ -782,6 +782,9 @@ Patch22261: 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
|
|||
#rhbz 914737
|
||||
Patch22262: x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
|
||||
|
||||
#CVE-2013-1767 rhbz 915592,915716
|
||||
Patch22263: tmpfs-fix-use-after-free-of-mempolicy-object.patch
|
||||
|
||||
Patch23000: silence-brcmsmac-warning.patch
|
||||
|
||||
#rhbz 812111
|
||||
|
@ -1519,6 +1522,9 @@ ApplyPatch 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
|
|||
#rhbz 914737
|
||||
ApplyPatch x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
|
||||
|
||||
#CVE-2013-1767 rhbz 915592,915716
|
||||
ApplyPatch tmpfs-fix-use-after-free-of-mempolicy-object.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2375,6 +2381,7 @@ fi
|
|||
# '-'
|
||||
%changelog
|
||||
* Tue Feb 26 2013 Josh Boyer <jwboyer@redhat.com>
|
||||
- CVE-2013-1767 tmpfs: fix use-after-free of mempolicy obj (rhbz 915592,915716)
|
||||
- Fix vmalloc_fault oops during lazy MMU (rhbz 914737)
|
||||
|
||||
* Mon Feb 25 2013 Josh Boyer <jwboyer@redhat.com>
|
||||
|
|
|
@ -0,0 +1,107 @@
|
|||
From 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 Mon Sep 17 00:00:00 2001
|
||||
From: Greg Thelen <gthelen@google.com>
|
||||
Date: Fri, 22 Feb 2013 16:36:01 -0800
|
||||
Subject: [PATCH] tmpfs: fix use-after-free of mempolicy object
|
||||
|
||||
The tmpfs remount logic preserves filesystem mempolicy if the mpol=M
|
||||
option is not specified in the remount request. A new policy can be
|
||||
specified if mpol=M is given.
|
||||
|
||||
Before this patch remounting an mpol bound tmpfs without specifying
|
||||
mpol= mount option in the remount request would set the filesystem's
|
||||
mempolicy object to a freed mempolicy object.
|
||||
|
||||
To reproduce the problem boot a DEBUG_PAGEALLOC kernel and run:
|
||||
# mkdir /tmp/x
|
||||
|
||||
# mount -t tmpfs -o size=100M,mpol=interleave nodev /tmp/x
|
||||
|
||||
# grep /tmp/x /proc/mounts
|
||||
nodev /tmp/x tmpfs rw,relatime,size=102400k,mpol=interleave:0-3 0 0
|
||||
|
||||
# mount -o remount,size=200M nodev /tmp/x
|
||||
|
||||
# grep /tmp/x /proc/mounts
|
||||
nodev /tmp/x tmpfs rw,relatime,size=204800k,mpol=??? 0 0
|
||||
# note ? garbage in mpol=... output above
|
||||
|
||||
# dd if=/dev/zero of=/tmp/x/f count=1
|
||||
# panic here
|
||||
|
||||
Panic:
|
||||
BUG: unable to handle kernel NULL pointer dereference at (null)
|
||||
IP: [< (null)>] (null)
|
||||
[...]
|
||||
Oops: 0010 [#1] SMP DEBUG_PAGEALLOC
|
||||
Call Trace:
|
||||
mpol_shared_policy_init+0xa5/0x160
|
||||
shmem_get_inode+0x209/0x270
|
||||
shmem_mknod+0x3e/0xf0
|
||||
shmem_create+0x18/0x20
|
||||
vfs_create+0xb5/0x130
|
||||
do_last+0x9a1/0xea0
|
||||
path_openat+0xb3/0x4d0
|
||||
do_filp_open+0x42/0xa0
|
||||
do_sys_open+0xfe/0x1e0
|
||||
compat_sys_open+0x1b/0x20
|
||||
cstar_dispatch+0x7/0x1f
|
||||
|
||||
Non-debug kernels will not crash immediately because referencing the
|
||||
dangling mpol will not cause a fault. Instead the filesystem will
|
||||
reference a freed mempolicy object, which will cause unpredictable
|
||||
behavior.
|
||||
|
||||
The problem boils down to a dropped mpol reference below if
|
||||
shmem_parse_options() does not allocate a new mpol:
|
||||
|
||||
config = *sbinfo
|
||||
shmem_parse_options(data, &config, true)
|
||||
mpol_put(sbinfo->mpol)
|
||||
sbinfo->mpol = config.mpol /* BUG: saves unreferenced mpol */
|
||||
|
||||
This patch avoids the crash by not releasing the mempolicy if
|
||||
shmem_parse_options() doesn't create a new mpol.
|
||||
|
||||
How far back does this issue go? I see it in both 2.6.36 and 3.3. I did
|
||||
not look back further.
|
||||
|
||||
Signed-off-by: Greg Thelen <gthelen@google.com>
|
||||
Acked-by: Hugh Dickins <hughd@google.com>
|
||||
Cc: <stable@vger.kernel.org>
|
||||
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
mm/shmem.c | 10 ++++++++--
|
||||
1 file changed, 8 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/mm/shmem.c b/mm/shmem.c
|
||||
index 7162c58..5e2ff59 100644
|
||||
--- a/mm/shmem.c
|
||||
+++ b/mm/shmem.c
|
||||
@@ -2486,6 +2486,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
|
||||
unsigned long inodes;
|
||||
int error = -EINVAL;
|
||||
|
||||
+ config.mpol = NULL;
|
||||
if (shmem_parse_options(data, &config, true))
|
||||
return error;
|
||||
|
||||
@@ -2510,8 +2511,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
|
||||
sbinfo->max_inodes = config.max_inodes;
|
||||
sbinfo->free_inodes = config.max_inodes - inodes;
|
||||
|
||||
- mpol_put(sbinfo->mpol);
|
||||
- sbinfo->mpol = config.mpol; /* transfers initial ref */
|
||||
+ /*
|
||||
+ * Preserve previous mempolicy unless mpol remount option was specified.
|
||||
+ */
|
||||
+ if (config.mpol) {
|
||||
+ mpol_put(sbinfo->mpol);
|
||||
+ sbinfo->mpol = config.mpol; /* transfers initial ref */
|
||||
+ }
|
||||
out:
|
||||
spin_unlock(&sbinfo->stat_lock);
|
||||
return error;
|
||||
--
|
||||
1.8.1.2
|
||||
|
Loading…
Reference in New Issue