From patchwork Wed Oct 7 13:42:15 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Whitcroft X-Patchwork-Id: 527292 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id B4F8C140D89; Thu, 8 Oct 2015 00:42:44 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1ZjozR-0004sz-Bi; Wed, 07 Oct 2015 13:42:41 +0000 Received: from mail-wi0-f174.google.com ([209.85.212.174]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1Zjoz9-0004lo-P5 for kernel-team@lists.ubuntu.com; Wed, 07 Oct 2015 13:42:23 +0000 Received: by wicgb1 with SMTP id gb1so212065886wic.1 for ; Wed, 07 Oct 2015 06:42:23 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=k8fnd4lsv+/bhe45oEWgZo1ZwnPdA1be68EgvXgx3ek=; b=jvOpTiQgxxiTrXlb1lBNdlIA3+2p5Iu4vREZsFoAvm9+QHOxeSBFupdzCTpE3roKkB GbzeT77yyVKwU80bdJcvIVqY5ABXycFJoNzA9iXkKIs9acRvYq2I+bzUcnOdsT12MpXJ aQwuP/+TZlubrboNsp7s57YYHbiS1FE4kx2rL5YAJ4339lpEIsP8wDG0hldBzq103u6R W7y2JV/EMIWo95pn04QyFmfdEvxATakX+npl9dXFCH0fBzJXlAj/sUbmyWW2HpyPbVCx Avt/VsH4GI4uHdlkHdOcrgLa1g/QXsRHyAwjs2KOtVM7okr8Ay1pqowZMSaEyIEgrsas RAgQ== X-Gm-Message-State: ALoCoQm++pqxjdM073CgohX0HdTJmwFqK8jDbgPtdaI6FqNxOI0wdo2CdYAfPL7vJNFsy/xwMHJX X-Received: by 10.194.116.73 with SMTP id ju9mr1306929wjb.108.1444225343488; Wed, 07 Oct 2015 06:42:23 -0700 (PDT) Received: from localhost ([2001:470:6973:2:7598:aede:4690:3e43]) by smtp.gmail.com with ESMTPSA id x7sm2670350wia.10.2015.10.07.06.42.22 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 07 Oct 2015 06:42:22 -0700 (PDT) From: Andy Whitcroft To: kernel-team@lists.ubuntu.com Subject: [trusty/lts-backport-utopic-next 2/2] UBUNTU: SAUCE: aufs3: mmap: Fix races in madvise_remove() and sys_msync() Date: Wed, 7 Oct 2015 14:42:15 +0100 Message-Id: <1444225339-5467-3-git-send-email-apw@canonical.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1444225339-5467-1-git-send-email-apw@canonical.com> References: <1444225339-5467-1-git-send-email-apw@canonical.com> Cc: Andy Whitcroft X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com From: Ben Hutchings In madvise_remove() and sys_msync() we drop the mmap_sem before dropping references to the mapped file(s). As soon as we drop the mmap_sem, the vma we got them from might be destroyed by another thread, so calling vma_do_fput() is a possible use-after-free. In these cases we don't actually need a reference to the aufs file, so revert to using get_file() and fput() directly. Bug-Link: https://bugs.debian.org/796036 CVE-2015-7312 BugLink: http://bugs.launchpad.net/bugs/1503655 Signed-off-by: Ben Hutchings Signed-off-by: Andy Whitcroft Acked-by: Stefan Bader Acked-by: Tim Gardner Signed-off-by: Brad Figg --- mm/madvise.c | 4 ++-- mm/msync.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/mm/madvise.c b/mm/madvise.c index 8fa9f2a..1001381 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -328,12 +328,12 @@ static long madvise_remove(struct vm_area_struct *vma, * vma's reference to the file) can go away as soon as we drop * mmap_sem. */ - vma_get_file(vma); + get_file(f); up_read(¤t->mm->mmap_sem); error = do_fallocate(f, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, offset, end - start); - vma_fput(vma); + fput(f); down_read(¤t->mm->mmap_sem); return error; } diff --git a/mm/msync.c b/mm/msync.c index 69b7303..0950c7b 100644 --- a/mm/msync.c +++ b/mm/msync.c @@ -85,13 +85,13 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags) start = vma->vm_end; if ((flags & MS_SYNC) && file && (vma->vm_flags & VM_SHARED)) { - vma_get_file(vma); + get_file(file); up_read(&mm->mmap_sem); if (vma->vm_flags & VM_NONLINEAR) error = vfs_fsync(file, 1); else error = vfs_fsync_range(file, fstart, fend, 1); - vma_fput(vma); + fput(file); if (error || start >= end) goto out; down_read(&mm->mmap_sem);