3.16-stable patches

added patches:
	fanotify-fix-double-free-of-pending-permission-events.patch

diff --git a/queue-3.16/fanotify-fix-double-free-of-pending-permission-events.patch b/queue-3.16/fanotify-fix-double-free-of-pending-permission-events.patch
new file mode 100644 (file)
index 0000000..ab36bbe
--- /dev/null
+++ b/queue-3.16/fanotify-fix-double-free-of-pending-permission-events.patch
@@ -0,0 +1,128 @@
+From 5838d4442bd5971687b72221736222637e03140d Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 6 Aug 2014 16:03:28 -0700
+Subject: fanotify: fix double free of pending permission events
+
+From: Jan Kara <jack@suse.cz>
+
+commit 5838d4442bd5971687b72221736222637e03140d upstream.
+
+Commit 85816794240b ("fanotify: Fix use after free for permission
+events") introduced a double free issue for permission events which are
+pending in group's notification queue while group is being destroyed.
+These events are freed from fanotify_handle_event() but they are not
+removed from groups notification queue and thus they get freed again
+from fsnotify_flush_notify().
+
+Fix the problem by removing permission events from notification queue
+before freeing them if we skip processing access response.  Also expand
+comments in fanotify_release() to explain group shutdown in detail.
+
+Fixes: 85816794240b9659e66e4d9b0df7c6e814e5f603
+Signed-off-by: Jan Kara <jack@suse.cz>
+Reported-by: Douglas Leeder <douglas.leeder@sophos.com>
+Tested-by: Douglas Leeder <douglas.leeder@sophos.com>
+Reported-by: Heinrich Schuchard <xypron.glpk@gmx.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/notify/fanotify/fanotify.c      |    9 ++++++++-
+ fs/notify/fanotify/fanotify_user.c |   12 ++++++++++++
+ fs/notify/notification.c           |   18 +++++++++++++++++-
+ include/linux/fsnotify_backend.h   |    2 ++
+ 4 files changed, 39 insertions(+), 2 deletions(-)
+
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -70,8 +70,15 @@ static int fanotify_get_response(struct
+       wait_event(group->fanotify_data.access_waitq, event->response ||
+                               atomic_read(&group->fanotify_data.bypass_perm));
+ 
+-      if (!event->response) /* bypass_perm set */
++      if (!event->response) { /* bypass_perm set */
++              /*
++               * Event was canceled because group is being destroyed. Remove
++               * it from group's event list because we are responsible for
++               * freeing the permission event.
++               */
++              fsnotify_remove_event(group, &event->fae.fse);
+               return 0;
++      }
+ 
+       /* userspace responded, convert to something usable */
+       switch (event->response) {
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -359,6 +359,11 @@ static int fanotify_release(struct inode
+ #ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
+       struct fanotify_perm_event_info *event, *next;
+ 
++      /*
++       * There may be still new events arriving in the notification queue
++       * but since userspace cannot use fanotify fd anymore, no event can
++       * enter or leave access_list by now.
++       */
+       spin_lock(&group->fanotify_data.access_lock);
+ 
+       atomic_inc(&group->fanotify_data.bypass_perm);
+@@ -373,6 +378,13 @@ static int fanotify_release(struct inode
+       }
+       spin_unlock(&group->fanotify_data.access_lock);
+ 
++      /*
++       * Since bypass_perm is set, newly queued events will not wait for
++       * access response. Wake up the already sleeping ones now.
++       * synchronize_srcu() in fsnotify_destroy_group() will wait for all
++       * processes sleeping in fanotify_handle_event() waiting for access
++       * response and thus also for all permission events to be freed.
++       */
+       wake_up(&group->fanotify_data.access_waitq);
+ #endif
+ 
+--- a/fs/notify/notification.c
++++ b/fs/notify/notification.c
+@@ -73,7 +73,8 @@ void fsnotify_destroy_event(struct fsnot
+       /* Overflow events are per-group and we don't want to free them */
+       if (!event || event->mask == FS_Q_OVERFLOW)
+               return;
+-
++      /* If the event is still queued, we have a problem... */
++      WARN_ON(!list_empty(&event->list));
+       group->ops->free_event(event);
+ }
+ 
+@@ -125,6 +126,21 @@ queue:
+ }
+ 
+ /*
++ * Remove @event from group's notification queue. It is the responsibility of
++ * the caller to destroy the event.
++ */
++void fsnotify_remove_event(struct fsnotify_group *group,
++                         struct fsnotify_event *event)
++{
++      mutex_lock(&group->notification_mutex);
++      if (!list_empty(&event->list)) {
++              list_del_init(&event->list);
++              group->q_len--;
++      }
++      mutex_unlock(&group->notification_mutex);
++}
++
++/*
+  * Remove and return the first event from the notification list.  It is the
+  * responsibility of the caller to destroy the obtained event
+  */
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -326,6 +326,8 @@ extern int fsnotify_add_notify_event(str
+                                    struct fsnotify_event *event,
+                                    int (*merge)(struct list_head *,
+                                                 struct fsnotify_event *));
++/* Remove passed event from groups notification queue */
++extern void fsnotify_remove_event(struct fsnotify_group *group, struct fsnotify_event *event);
+ /* true if the group notification queue is empty */
+ extern bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group);
+ /* return, but do not dequeue the first event on the notification queue */

diff --git a/queue-3.16/series b/queue-3.16/series
index c0e1475e2e92d25eda0106e9481d7e66f55366ba..86f0ba4e31a64eaa33cd9f22f799af1254ce34c0 100644 (file)
--- a/queue-3.16/series
+++ b/queue-3.16/series
@@ -22,3 +22,4 @@ tpm-missing-tpm_chip_put-in-tpm_get_random.patch
 tpm-provide-a-generic-means-to-override-the-chip-returned-timeouts.patch
 tpm-properly-clean-sysfs-entries-in-error-path.patch
 capabilities-remove-undefined-caps-from-all-processes.patch
+fanotify-fix-double-free-of-pending-permission-events.patch