[SRU,L/K/J/F/OEM-5.17/OEM-6.0/OEM-6.1,0/1] shiftfs: fix locking in shiftfs_create_object()

[Impact]

In shiftfs_create_object() we use the lower dir inode operations without
properly locking the inode on the lower dir object.

When unprivileged user namespaces are enabled, which is the default, this
could be exploited by an unprivileged user to trigger system crashes or
soft lockups.

[Test case]

A PoC triggering a soft lockup was tested.

[Fix]

Make sure to properly lock the lower dir inode before accessing the
inode_operations object.

[Regression potential]

This patch only affects shiftfs, so we may only notice regressions with
shiftfs (even if the fix is pretty trivial).

On 5/10/23 3:44 PM, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> 
> In shiftfs_create_object() we use the lower dir inode operations without
> properly locking the inode on the lower dir object.
> 
> When unprivileged user namespaces are enabled, which is the default, this
> could be exploited by an unprivileged user to trigger system crashes or
> soft lockups.
> 
> [Test case]
> 
> A PoC triggering a soft lockup was tested.
> 
> [Fix]
> 
> Make sure to properly lock the lower dir inode before accessing the
> inode_operations object.
> 
> [Regression potential]
> 
> This patch only affects shiftfs, so we may only notice regressions with
> shiftfs (even if the fix is pretty trivial).
> 
> 
> 

Acked-by: John Cabaj <john.cabaj@canonical.com>

On Wed, May 10, 2023 at 05:44:12PM -0300, Thadeu Lima de Souza Cascardo wrote:
> [Impact]
> 
> In shiftfs_create_object() we use the lower dir inode operations without
> properly locking the inode on the lower dir object.
> 
> When unprivileged user namespaces are enabled, which is the default, this
> could be exploited by an unprivileged user to trigger system crashes or
> soft lockups.
> 
> [Test case]
> 
> A PoC triggering a soft lockup was tested.
> 
> [Fix]
> 
> Make sure to properly lock the lower dir inode before accessing the
> inode_operations object.
> 
> [Regression potential]
> 
> This patch only affects shiftfs, so we may only notice regressions with
> shiftfs (even if the fix is pretty trivial).
> 
> 
> 
> -- 
Acked-by: Cory Todd <cory.todd@canonical.com>

Applied to lunar, kinetic, jammy, focal linux master-next

Thanks,
- Luke

On Wed, May 10, 2023 at 10:44 PM Thadeu Lima de Souza Cascardo <
cascardo@canonical.com> wrote:

> [Impact]
>
> In shiftfs_create_object() we use the lower dir inode operations without
> properly locking the inode on the lower dir object.
>
> When unprivileged user namespaces are enabled, which is the default, this
> could be exploited by an unprivileged user to trigger system crashes or
> soft lockups.
>
> [Test case]
>
> A PoC triggering a soft lockup was tested.
>
> [Fix]
>
> Make sure to properly lock the lower dir inode before accessing the
> inode_operations object.
>
> [Regression potential]
>
> This patch only affects shiftfs, so we may only notice regressions with
> shiftfs (even if the fix is pretty trivial).
>
>
>
> --
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>

Thadeu Lima de Souza Cascardo kirjoitti 10.5.2023 klo 23.44:
> [Impact]
> 
> In shiftfs_create_object() we use the lower dir inode operations without
> properly locking the inode on the lower dir object.
> 
> When unprivileged user namespaces are enabled, which is the default, this
> could be exploited by an unprivileged user to trigger system crashes or
> soft lockups.
> 
> [Test case]
> 
> A PoC triggering a soft lockup was tested.
> 
> [Fix]
> 
> Make sure to properly lock the lower dir inode before accessing the
> inode_operations object.
> 
> [Regression potential]
> 
> This patch only affects shiftfs, so we may only notice regressions with
> shiftfs (even if the fix is pretty trivial).
> 

applied to oem kernels, thanks