From patchwork Fri May 8 18:44:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537439 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D9C9C14C0 for ; Fri, 8 May 2020 18:47:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C9EFF218AC for ; Fri, 8 May 2020 18:47:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726863AbgEHSrt (ORCPT ); Fri, 8 May 2020 14:47:49 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:53562 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726756AbgEHSrt (ORCPT ); Fri, 8 May 2020 14:47:49 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out03.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX82F-0001Dp-NB; Fri, 08 May 2020 12:47:47 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX82F-0002qd-2G; Fri, 08 May 2020 12:47:47 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:44:19 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <87mu6i6zcs.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX82F-0002qd-2G;;;mid=<87mu6i6zcs.fsf_-_@x220.int.ebiederm.org>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX18wYKPEvakFJCUELsQOPDMEKQPVyGLjgUg= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa07.xmission.com X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,T_TooManySym_01,XMNoVowels,XMSubLong autolearn=disabled version=3.4.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.7 XMSubLong Long Subject * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa07 0; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: ; sa07 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **; X-Spam-Relay-Country: X-Spam-Timing: total 281 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 12 (4.1%), b_tie_ro: 10 (3.6%), parse: 0.96 (0.3%), extract_message_metadata: 12 (4.3%), get_uri_detail_list: 1.20 (0.4%), tests_pri_-1000: 13 (4.7%), tests_pri_-950: 1.22 (0.4%), tests_pri_-900: 0.98 (0.4%), tests_pri_-90: 47 (16.7%), check_bayes: 45 (16.2%), b_tokenize: 6 (2.1%), b_tok_get_all: 6 (2.1%), b_comp_prob: 1.86 (0.7%), b_tok_touch_all: 29 (10.2%), b_finish: 0.88 (0.3%), tests_pri_0: 181 (64.4%), check_dkim_signature: 0.48 (0.2%), check_dkim_adsp: 2.2 (0.8%), poll_dns_idle: 0.49 (0.2%), tests_pri_10: 2.8 (1.0%), tests_pri_500: 7 (2.6%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 1/6] exec: Move the comment from above de_thread to above unshare_sighand X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org The comment describes work that now happens in unshare_sighand so move the comment where it makes sense. Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 3cc40048cc65..d4387bc92292 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1093,12 +1093,6 @@ static int exec_mmap(struct mm_struct *mm) return 0; } -/* - * This function makes sure the current process has its own signal table, - * so that flush_signal_handlers can later reset the handlers without - * disturbing other processes. (Other processes might share the signal - * table via the CLONE_SIGHAND option to clone().) - */ static int de_thread(struct task_struct *tsk) { struct signal_struct *sig = tsk->signal; @@ -1240,6 +1234,12 @@ static int de_thread(struct task_struct *tsk) } +/* + * This function makes sure the current process has its own signal table, + * so that flush_signal_handlers can later reset the handlers without + * disturbing other processes. (Other processes might share the signal + * table via the CLONE_SIGHAND option to clone().) + */ static int unshare_sighand(struct task_struct *me) { struct sighand_struct *oldsighand = me->sighand; From patchwork Fri May 8 18:44:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537441 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2E94914B4 for ; Fri, 8 May 2020 18:48:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1F53F207DD for ; Fri, 8 May 2020 18:48:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727783AbgEHSsP (ORCPT ); Fri, 8 May 2020 14:48:15 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:54346 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726756AbgEHSsP (ORCPT ); Fri, 8 May 2020 14:48:15 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX82g-0005OS-CG; Fri, 08 May 2020 12:48:14 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX82f-0004Z3-Fu; Fri, 08 May 2020 12:48:14 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:44:46 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <87h7wq6zc1.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX82f-0004Z3-Fu;;;mid=<87h7wq6zc1.fsf_-_@x220.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX18I4XqN+zQietoOeTu38q9Y+IWIWtiZyE0= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa07.xmission.com X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,T_TooManySym_01,XMNoVowels,XMSubLong autolearn=disabled version=3.4.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.7 XMSubLong Long Subject * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa07 0; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: ; sa07 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **; X-Spam-Relay-Country: X-Spam-Timing: total 474 ms - load_scoreonly_sql: 0.07 (0.0%), signal_user_changed: 16 (3.4%), b_tie_ro: 15 (3.1%), parse: 1.29 (0.3%), extract_message_metadata: 17 (3.6%), get_uri_detail_list: 1.16 (0.2%), tests_pri_-1000: 20 (4.1%), tests_pri_-950: 1.77 (0.4%), tests_pri_-900: 1.45 (0.3%), tests_pri_-90: 183 (38.7%), check_bayes: 181 (38.2%), b_tokenize: 8 (1.6%), b_tok_get_all: 7 (1.4%), b_comp_prob: 3.2 (0.7%), b_tok_touch_all: 159 (33.6%), b_finish: 1.00 (0.2%), tests_pri_0: 215 (45.4%), check_dkim_signature: 0.80 (0.2%), check_dkim_adsp: 2.8 (0.6%), poll_dns_idle: 0.56 (0.1%), tests_pri_10: 3.3 (0.7%), tests_pri_500: 10 (2.1%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 2/6] exec: Fix spelling of search_binary_handler in a comment X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index d4387bc92292..82106241ed53 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1296,7 +1296,7 @@ void __set_task_comm(struct task_struct *tsk, const char *buf, bool exec) * Calling this is the point of no return. None of the failures will be * seen by userspace since either the process is already taking a fatal * signal (via de_thread() or coredump), or will have SEGV raised - * (after exec_mmap()) by search_binary_handlers (see below). + * (after exec_mmap()) by search_binary_handler (see below). */ int begin_new_exec(struct linux_binprm * bprm) { From patchwork Fri May 8 18:45:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537443 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B3A2E14B4 for ; Fri, 8 May 2020 18:48:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A5957207DD for ; Fri, 8 May 2020 18:48:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727798AbgEHSsy (ORCPT ); Fri, 8 May 2020 14:48:54 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:54612 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726864AbgEHSsx (ORCPT ); Fri, 8 May 2020 14:48:53 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX83I-0005SA-Sr; Fri, 08 May 2020 12:48:52 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX83I-0002xa-4g; Fri, 08 May 2020 12:48:52 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:45:25 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <87blmy6zay.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX83I-0002xa-4g;;;mid=<87blmy6zay.fsf_-_@x220.int.ebiederm.org>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/M8xbipLE7+kJXgkEYUSylu3e6cNqDnCs= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa02.xmission.com X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,T_TM2_M_HEADER_IN_MSG,T_TooManySym_01,XMNoVowels, XMSubLong autolearn=disabled version=3.4.2 X-Spam-Virus: No X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 0.7 XMSubLong Long Subject * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.0 T_TM2_M_HEADER_IN_MSG BODY: No description available. * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa02 0; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: ; sa02 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **; X-Spam-Relay-Country: X-Spam-Timing: total 299 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 3.7 (1.2%), b_tie_ro: 2.5 (0.9%), parse: 0.74 (0.2%), extract_message_metadata: 9 (2.9%), get_uri_detail_list: 0.86 (0.3%), tests_pri_-1000: 11 (3.5%), tests_pri_-950: 1.01 (0.3%), tests_pri_-900: 0.81 (0.3%), tests_pri_-90: 62 (20.7%), check_bayes: 61 (20.3%), b_tokenize: 5 (1.8%), b_tok_get_all: 5 (1.7%), b_comp_prob: 1.55 (0.5%), b_tok_touch_all: 46 (15.5%), b_finish: 0.63 (0.2%), tests_pri_0: 202 (67.6%), check_dkim_signature: 0.38 (0.1%), check_dkim_adsp: 2.3 (0.8%), poll_dns_idle: 0.92 (0.3%), tests_pri_10: 1.77 (0.6%), tests_pri_500: 5 (1.8%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 3/6] exec: Stop open coding mutex_lock_killable of cred_guard_mutex X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Oleg modified the code that did "mutex_lock_interruptible(¤t->cred_guard_mutex)" to return -ERESTARTNOINTR instead of -EINTR, so that userspace will never see a failure to grab the mutex. Slightly earlier Liam R. Howlett defined mutex_lock_killable for exactly the same situation but it does it a little more cleanly. Switch the code to mutex_lock_killable so that it is clearer what the code is doing. Ref: ad776537cc6b ("Add mutex_lock_killable") Ref: 793285fcafce ("cred_guard_mutex: do not return -EINTR to user-space") Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 5 +++-- kernel/ptrace.c | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 82106241ed53..11a5c073aa35 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1493,8 +1493,9 @@ EXPORT_SYMBOL(finalize_exec); */ static int prepare_bprm_creds(struct linux_binprm *bprm) { - if (mutex_lock_interruptible(¤t->signal->cred_guard_mutex)) - return -ERESTARTNOINTR; + int retval = mutex_lock_killable(¤t->signal->cred_guard_mutex); + if (retval) + return retval; bprm->cred = prepare_exec_creds(); if (likely(bprm->cred)) diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 43d6179508d6..1876b3392488 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -391,8 +391,8 @@ static int ptrace_attach(struct task_struct *task, long request, * SUID, SGID and LSM creds get determined differently * under ptrace. */ - retval = -ERESTARTNOINTR; - if (mutex_lock_interruptible(&task->signal->cred_guard_mutex)) + retval = mutex_lock_killable(&task->signal->cred_guard_mutex); + if (retval) goto out; task_lock(task); From patchwork Fri May 8 18:45:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537445 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D8C9914B4 for ; Fri, 8 May 2020 18:49:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CA55A218AC for ; Fri, 8 May 2020 18:49:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726863AbgEHStZ (ORCPT ); Fri, 8 May 2020 14:49:25 -0400 Received: from out02.mta.xmission.com ([166.70.13.232]:38412 "EHLO out02.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726767AbgEHStZ (ORCPT ); Fri, 8 May 2020 14:49:25 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out02.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX83n-00046H-SA; Fri, 08 May 2020 12:49:23 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX83n-00031t-5l; Fri, 08 May 2020 12:49:23 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:45:56 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <875zd66za3.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX83n-00031t-5l;;;mid=<875zd66za3.fsf_-_@x220.int.ebiederm.org>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1+AXon5dcUfjuMt0Bp8k9tiBqs0tFK9Qcg= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa07.xmission.com X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,T_TooManySym_01,XMNoVowels,XMSubLong autolearn=disabled version=3.4.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.7 XMSubLong Long Subject * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa07 0; Body=1 Fuz1=1 Fuz2=1] * 0.0 T_TooManySym_01 4+ unique symbols in subject X-Spam-DCC: ; sa07 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **; X-Spam-Relay-Country: X-Spam-Timing: total 282 ms - load_scoreonly_sql: 0.03 (0.0%), signal_user_changed: 11 (3.8%), b_tie_ro: 9 (3.3%), parse: 0.85 (0.3%), extract_message_metadata: 10 (3.6%), get_uri_detail_list: 0.77 (0.3%), tests_pri_-1000: 13 (4.7%), tests_pri_-950: 1.24 (0.4%), tests_pri_-900: 1.01 (0.4%), tests_pri_-90: 74 (26.1%), check_bayes: 72 (25.6%), b_tokenize: 6 (2.0%), b_tok_get_all: 4.5 (1.6%), b_comp_prob: 1.85 (0.7%), b_tok_touch_all: 57 (20.3%), b_finish: 0.81 (0.3%), tests_pri_0: 159 (56.4%), check_dkim_signature: 0.48 (0.2%), check_dkim_adsp: 2.2 (0.8%), poll_dns_idle: 0.52 (0.2%), tests_pri_10: 2.1 (0.7%), tests_pri_500: 7 (2.6%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 4/6] exec: Run sync_mm_rss before taking exec_update_mutex X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Like exec_mm_release sync_mm_rss is about flushing out the state of the old_mm, which does not need to happen under exec_update_mutex. Make this explicit by moving sync_mm_rss outside of exec_update_mutex. Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index 11a5c073aa35..15682a1dfee9 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1051,13 +1051,14 @@ static int exec_mmap(struct mm_struct *mm) tsk = current; old_mm = current->mm; exec_mm_release(tsk, old_mm); + if (old_mm) + sync_mm_rss(old_mm); ret = mutex_lock_killable(&tsk->signal->exec_update_mutex); if (ret) return ret; if (old_mm) { - sync_mm_rss(old_mm); /* * Make sure that if there is a core dump in progress * for the old mm, we get out and die instead of going From patchwork Fri May 8 18:47:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537447 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9909814B4 for ; Fri, 8 May 2020 18:50:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8AEA8218AC for ; Fri, 8 May 2020 18:50:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727083AbgEHSuj (ORCPT ); Fri, 8 May 2020 14:50:39 -0400 Received: from out01.mta.xmission.com ([166.70.13.231]:54972 "EHLO out01.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726767AbgEHSuj (ORCPT ); Fri, 8 May 2020 14:50:39 -0400 Received: from in01.mta.xmission.com ([166.70.13.51]) by out01.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX84z-0005ZA-W0; Fri, 08 May 2020 12:50:38 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in01.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX84z-0003BB-7i; Fri, 08 May 2020 12:50:37 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:47:10 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <87y2q25knl.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX84z-0003BB-7i;;;mid=<87y2q25knl.fsf_-_@x220.int.ebiederm.org>;;;hst=in01.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1+FnkFDblASDXzpBgep8n0qUcQ6c8wP+Zg= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa05.xmission.com X-Spam-Level: ** X-Spam-Status: No, score=2.0 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,XMNoVowels,XMSubLong autolearn=disabled version=3.4.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 1.5 XMNoVowels Alpha-numberic number with no vowels * 0.7 XMSubLong Long Subject * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa05 0; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: ; sa05 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: **; X-Spam-Relay-Country: X-Spam-Timing: total 435 ms - load_scoreonly_sql: 0.11 (0.0%), signal_user_changed: 14 (3.1%), b_tie_ro: 11 (2.6%), parse: 1.85 (0.4%), extract_message_metadata: 19 (4.5%), get_uri_detail_list: 2.7 (0.6%), tests_pri_-1000: 21 (4.7%), tests_pri_-950: 1.81 (0.4%), tests_pri_-900: 1.48 (0.3%), tests_pri_-90: 65 (14.9%), check_bayes: 62 (14.4%), b_tokenize: 10 (2.3%), b_tok_get_all: 8 (1.9%), b_comp_prob: 2.9 (0.7%), b_tok_touch_all: 38 (8.8%), b_finish: 0.97 (0.2%), tests_pri_0: 284 (65.2%), check_dkim_signature: 0.90 (0.2%), check_dkim_adsp: 3.0 (0.7%), poll_dns_idle: 0.55 (0.1%), tests_pri_10: 4.4 (1.0%), tests_pri_500: 18 (4.2%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 5/6] exec: Move handling of the point of no return to the top level X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in01.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Move the handing of the point of no return from search_binary_handler into __do_execve_file so that it is easier to find, and to keep things robust in the face of change. Make it clear that an existing fatal signal will take precedence over a forced SIGSEGV by not forcing SIGSEGV if a fatal signal is already pending. This does not change the behavior but it saves a reader of the code the tedium of reading and understanding force_sig and the signal delivery code. Update the comment in begin_new_exec about where SIGSEGV is forced. Keep point_of_no_return from being a mystery by documenting what the code is doing where it forces SIGSEGV if the code is past the point of no return. Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 15682a1dfee9..443eb960f9a0 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1329,8 +1329,8 @@ int begin_new_exec(struct linux_binprm * bprm) /* * With the new mm installed it is completely impossible to * fail and return to the original process. If anything from - * here on returns an error, the check in - * search_binary_handler() will SEGV current. + * here on returns an error, the check in __do_execve_file() + * will SEGV current. */ bprm->point_of_no_return = true; bprm->mm = NULL; @@ -1722,13 +1722,8 @@ int search_binary_handler(struct linux_binprm *bprm) read_lock(&binfmt_lock); put_binfmt(fmt); - if (retval < 0 && bprm->point_of_no_return) { - /* we got to flush_old_exec() and failed after it */ - read_unlock(&binfmt_lock); - force_sigsegv(SIGSEGV); - return retval; - } - if (retval != -ENOEXEC || !bprm->file) { + if (bprm->point_of_no_return || !bprm->file || + (retval != -ENOEXEC)) { read_unlock(&binfmt_lock); return retval; } @@ -1899,6 +1894,14 @@ static int __do_execve_file(int fd, struct filename *filename, return retval; out: + /* + * If past the point of no return ensure the the code never + * returns to the userspace process. Use an existing fatal + * signal if present otherwise terminate the process with + * SIGSEGV. + */ + if (bprm->point_of_no_return && !fatal_signal_pending(current)) + force_sigsegv(SIGSEGV); if (bprm->mm) { acct_arg_size(bprm, 0); mmput(bprm->mm); From patchwork Fri May 8 18:48:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Eric W. Biederman" X-Patchwork-Id: 11537449 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 07C7814B4 for ; Fri, 8 May 2020 18:51:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ECCEF207DD for ; Fri, 8 May 2020 18:51:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727823AbgEHSvp (ORCPT ); Fri, 8 May 2020 14:51:45 -0400 Received: from out03.mta.xmission.com ([166.70.13.233]:54374 "EHLO out03.mta.xmission.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726767AbgEHSvp (ORCPT ); Fri, 8 May 2020 14:51:45 -0400 Received: from in02.mta.xmission.com ([166.70.13.52]) by out03.mta.xmission.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jX861-0001Zv-3H; Fri, 08 May 2020 12:51:41 -0600 Received: from ip68-227-160-95.om.om.cox.net ([68.227.160.95] helo=x220.xmission.com) by in02.mta.xmission.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1jX860-00051f-83; Fri, 08 May 2020 12:51:40 -0600 From: ebiederm@xmission.com (Eric W. Biederman) To: Cc: Linus Torvalds , Oleg Nesterov , Jann Horn , Kees Cook , Greg Ungerer , Rob Landley , Bernd Edlinger , , Al Viro , Alexey Dobriyan , Andrew Morton References: <87h7wujhmz.fsf@x220.int.ebiederm.org> <87sgga6ze4.fsf@x220.int.ebiederm.org> Date: Fri, 08 May 2020 13:48:13 -0500 In-Reply-To: <87sgga6ze4.fsf@x220.int.ebiederm.org> (Eric W. Biederman's message of "Fri, 08 May 2020 13:43:31 -0500") Message-ID: <87sgga5klu.fsf_-_@x220.int.ebiederm.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 X-XM-SPF: eid=1jX860-00051f-83;;;mid=<87sgga5klu.fsf_-_@x220.int.ebiederm.org>;;;hst=in02.mta.xmission.com;;;ip=68.227.160.95;;;frm=ebiederm@xmission.com;;;spf=neutral X-XM-AID: U2FsdGVkX1/r6VtbU/6OvvVnJg0JFfeLOIy36zxgBMI= X-SA-Exim-Connect-IP: 68.227.160.95 X-SA-Exim-Mail-From: ebiederm@xmission.com X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on sa05.xmission.com X-Spam-Level: * X-Spam-Status: No, score=1.3 required=8.0 tests=ALL_TRUSTED,BAYES_50, DCC_CHECK_NEGATIVE,XMNoVowels autolearn=disabled version=3.4.2 X-Spam-Report: * -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP * 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% * [score: 0.5000] * 1.5 XMNoVowels Alpha-numberic number with no vowels * -0.0 DCC_CHECK_NEGATIVE Not listed in DCC * [sa05 0; Body=1 Fuz1=1 Fuz2=1] X-Spam-DCC: ; sa05 0; Body=1 Fuz1=1 Fuz2=1 X-Spam-Combo: *; X-Spam-Relay-Country: X-Spam-Timing: total 420 ms - load_scoreonly_sql: 0.11 (0.0%), signal_user_changed: 12 (2.8%), b_tie_ro: 10 (2.4%), parse: 1.27 (0.3%), extract_message_metadata: 13 (3.0%), get_uri_detail_list: 1.28 (0.3%), tests_pri_-1000: 15 (3.6%), tests_pri_-950: 1.45 (0.3%), tests_pri_-900: 1.12 (0.3%), tests_pri_-90: 57 (13.6%), check_bayes: 55 (13.2%), b_tokenize: 7 (1.7%), b_tok_get_all: 8 (1.8%), b_comp_prob: 2.9 (0.7%), b_tok_touch_all: 33 (8.0%), b_finish: 1.09 (0.3%), tests_pri_0: 269 (63.9%), check_dkim_signature: 1.11 (0.3%), check_dkim_adsp: 3.1 (0.7%), poll_dns_idle: 0.51 (0.1%), tests_pri_10: 2.1 (0.5%), tests_pri_500: 45 (10.7%), rewrite_mail: 0.00 (0.0%) Subject: [PATCH 6/6] exec: Set the point of no return sooner X-Spam-Flag: No X-SA-Exim-Version: 4.2.1 (built Thu, 05 May 2016 13:38:54 -0600) X-SA-Exim-Scanned: Yes (on in02.mta.xmission.com) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Make the code more robust by marking the point of no return sooner. This ensures that future code changes don't need to worry about how they return errors if they are past this point. This results in no actual change in behavior as __do_execve_file does not force SIGSEGV when there is a pending fatal signal pending past the point of no return. Further the only error returns from de_thread and exec_mmap that can occur result in fatal signals being pending. Signed-off-by: "Eric W. Biederman" Reviewed-by: Kees Cook --- fs/exec.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 443eb960f9a0..b0620d5ebc66 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1304,6 +1304,11 @@ int begin_new_exec(struct linux_binprm * bprm) struct task_struct *me = current; int retval; + /* + * Ensure all future errors are fatal. + */ + bprm->point_of_no_return = true; + /* * Make this the only thread in the thread group. */ @@ -1326,13 +1331,6 @@ int begin_new_exec(struct linux_binprm * bprm) if (retval) goto out; - /* - * With the new mm installed it is completely impossible to - * fail and return to the original process. If anything from - * here on returns an error, the check in __do_execve_file() - * will SEGV current. - */ - bprm->point_of_no_return = true; bprm->mm = NULL; #ifdef CONFIG_POSIX_TIMERS