From: Greg Kroah-Hartman Date: Fri, 18 May 2018 07:25:15 +0000 (+0200) Subject: 4.16-stable patches X-Git-Tag: v4.16.10~8 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d542c2f5084ab4b356a9ef5cf9c6bf7fe544bf69;p=thirdparty%2Fkernel%2Fstable-queue.git 4.16-stable patches added patches: proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch --- diff --git a/queue-4.16/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch b/queue-4.16/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch new file mode 100644 index 00000000000..7dfe4787605 --- /dev/null +++ b/queue-4.16/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch @@ -0,0 +1,102 @@ +From 7f7ccc2ccc2e70c6054685f5e3522efa81556830 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Fri, 11 May 2018 08:11:44 +0200 +Subject: proc: do not access cmdline nor environ from file-backed areas + +From: Willy Tarreau + +commit 7f7ccc2ccc2e70c6054685f5e3522efa81556830 upstream. + +proc_pid_cmdline_read() and environ_read() directly access the target +process' VM to retrieve the command line and environment. If this +process remaps these areas onto a file via mmap(), the requesting +process may experience various issues such as extra delays if the +underlying device is slow to respond. + +Let's simply refuse to access file-backed areas in these functions. +For this we add a new FOLL_ANON gup flag that is passed to all calls +to access_remote_vm(). The code already takes care of such failures +(including unmapped areas). Accesses via /proc/pid/mem were not +changed though. + +This was assigned CVE-2018-1120. + +Note for stable backports: the patch may apply to kernels prior to 4.11 +but silently miss one location; it must be checked that no call to +access_remote_vm() keeps zero as the last argument. + +Reported-by: Qualys Security Advisory +Cc: Linus Torvalds +Cc: Andy Lutomirski +Cc: Oleg Nesterov +Cc: stable@vger.kernel.org +Signed-off-by: Willy Tarreau +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 8 ++++---- + include/linux/mm.h | 1 + + mm/gup.c | 3 +++ + 3 files changed, 8 insertions(+), 4 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -264,7 +264,7 @@ static ssize_t proc_pid_cmdline_read(str + * Inherently racy -- command line shares address space + * with code and data. + */ +- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); ++ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); + if (rv <= 0) + goto out_free_page; + +@@ -282,7 +282,7 @@ static ssize_t proc_pid_cmdline_read(str + int nr_read; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -328,7 +328,7 @@ static ssize_t proc_pid_cmdline_read(str + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -946,7 +946,7 @@ static ssize_t environ_read(struct file + max_len = min_t(size_t, PAGE_SIZE, count); + this_len = min(max_len, this_len); + +- retval = access_remote_vm(mm, (env_start + src), page, this_len, 0); ++ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); + + if (retval <= 0) { + ret = retval; +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2441,6 +2441,7 @@ static inline struct page *follow_page(s + #define FOLL_MLOCK 0x1000 /* lock present pages */ + #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */ + #define FOLL_COW 0x4000 /* internal GUP flag */ ++#define FOLL_ANON 0x8000 /* don't do file mappings */ + + static inline int vm_fault_to_errno(int vm_fault, int foll_flags) + { +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -544,6 +544,9 @@ static int check_vma_flags(struct vm_are + if (vm_flags & (VM_IO | VM_PFNMAP)) + return -EFAULT; + ++ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) ++ return -EFAULT; ++ + if (write) { + if (!(vm_flags & VM_WRITE)) { + if (!(gup_flags & FOLL_FORCE)) diff --git a/queue-4.16/series b/queue-4.16/series index 70de15dd8fb..210e462032c 100644 --- a/queue-4.16/series +++ b/queue-4.16/series @@ -52,3 +52,4 @@ net-mlx5-fix-mlx5_get_vector_affinity-function.patch net-phy-sfp-fix-the-br-min-computation.patch net-smc-keep-clcsock-reference-in-smc_tcp_listen_work.patch scsi-aacraid-correct-hba_send-to-include-iu_type.patch +proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch