releases/4.4.14/ecryptfs-forbid-opening-files-without-mmap-handler.patch

   1 From 2f36db71009304b3f0b95afacd8eba1f9f046b87 Mon Sep 17 00:00:00 2001
   2 From: Jann Horn <jannh@google.com>
   3 Date: Wed, 1 Jun 2016 11:55:06 +0200
   4 Subject: ecryptfs: forbid opening files without mmap handler
   5
   6 From: Jann Horn <jannh@google.com>
   7
   8 commit 2f36db71009304b3f0b95afacd8eba1f9f046b87 upstream.
   9
  10 This prevents users from triggering a stack overflow through a recursive
  11 invocation of pagefault handling that involves mapping procfs files into
  12 virtual memory.
  13
  14 Signed-off-by: Jann Horn <jannh@google.com>
  15 Acked-by: Tyler Hicks <tyhicks@canonical.com>
  16 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18
  19 ---
  20  fs/ecryptfs/kthread.c |   13 +++++++++++--
  21  1 file changed, 11 insertions(+), 2 deletions(-)
  22
  23 --- a/fs/ecryptfs/kthread.c
  24 +++ b/fs/ecryptfs/kthread.c
  25 @@ -25,6 +25,7 @@
  26  #include <linux/slab.h>
  27  #include <linux/wait.h>
  28  #include <linux/mount.h>
  29 +#include <linux/file.h>
  30  #include "ecryptfs_kernel.h"
  31
  32  struct ecryptfs_open_req {
  33 @@ -147,7 +148,7 @@ int ecryptfs_privileged_open(struct file
  34         flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
  35         (*lower_file) = dentry_open(&req.path, flags, cred);
  36         if (!IS_ERR(*lower_file))
  37 -               goto out;
  38 +               goto have_file;
  39         if ((flags & O_ACCMODE) == O_RDONLY) {
  40                 rc = PTR_ERR((*lower_file));
  41                 goto out;
  42 @@ -165,8 +166,16 @@ int ecryptfs_privileged_open(struct file
  43         mutex_unlock(&ecryptfs_kthread_ctl.mux);
  44         wake_up(&ecryptfs_kthread_ctl.wait);
  45         wait_for_completion(&req.done);
  46 -       if (IS_ERR(*lower_file))
  47 +       if (IS_ERR(*lower_file)) {
  48                 rc = PTR_ERR(*lower_file);
  49 +               goto out;
  50 +       }
  51 +have_file:
  52 +       if ((*lower_file)->f_op->mmap == NULL) {
  53 +               fput(*lower_file);
  54 +               *lower_file = NULL;
  55 +               rc = -EMEDIUMTYPE;
  56 +       }
  57  out:
  58         return rc;
  59  }