From: Greg Kroah-Hartman Date: Fri, 18 May 2018 07:24:54 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.16.10~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=db79dafcf44a3101b9a6aa832b5bc23c59199ff2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch --- diff --git a/queue-4.14/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch b/queue-4.14/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch new file mode 100644 index 00000000000..2869ee3c00d --- /dev/null +++ b/queue-4.14/proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch @@ -0,0 +1,102 @@ +From 7f7ccc2ccc2e70c6054685f5e3522efa81556830 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Fri, 11 May 2018 08:11:44 +0200 +Subject: proc: do not access cmdline nor environ from file-backed areas + +From: Willy Tarreau + +commit 7f7ccc2ccc2e70c6054685f5e3522efa81556830 upstream. + +proc_pid_cmdline_read() and environ_read() directly access the target +process' VM to retrieve the command line and environment. If this +process remaps these areas onto a file via mmap(), the requesting +process may experience various issues such as extra delays if the +underlying device is slow to respond. + +Let's simply refuse to access file-backed areas in these functions. +For this we add a new FOLL_ANON gup flag that is passed to all calls +to access_remote_vm(). The code already takes care of such failures +(including unmapped areas). Accesses via /proc/pid/mem were not +changed though. + +This was assigned CVE-2018-1120. + +Note for stable backports: the patch may apply to kernels prior to 4.11 +but silently miss one location; it must be checked that no call to +access_remote_vm() keeps zero as the last argument. + +Reported-by: Qualys Security Advisory +Cc: Linus Torvalds +Cc: Andy Lutomirski +Cc: Oleg Nesterov +Cc: stable@vger.kernel.org +Signed-off-by: Willy Tarreau +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 8 ++++---- + include/linux/mm.h | 1 + + mm/gup.c | 3 +++ + 3 files changed, 8 insertions(+), 4 deletions(-) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -263,7 +263,7 @@ static ssize_t proc_pid_cmdline_read(str + * Inherently racy -- command line shares address space + * with code and data. + */ +- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); ++ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); + if (rv <= 0) + goto out_free_page; + +@@ -281,7 +281,7 @@ static ssize_t proc_pid_cmdline_read(str + int nr_read; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -327,7 +327,7 @@ static ssize_t proc_pid_cmdline_read(str + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -946,7 +946,7 @@ static ssize_t environ_read(struct file + max_len = min_t(size_t, PAGE_SIZE, count); + this_len = min(max_len, this_len); + +- retval = access_remote_vm(mm, (env_start + src), page, this_len, 0); ++ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); + + if (retval <= 0) { + ret = retval; +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2383,6 +2383,7 @@ static inline struct page *follow_page(s + #define FOLL_MLOCK 0x1000 /* lock present pages */ + #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */ + #define FOLL_COW 0x4000 /* internal GUP flag */ ++#define FOLL_ANON 0x8000 /* don't do file mappings */ + + static inline int vm_fault_to_errno(int vm_fault, int foll_flags) + { +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -544,6 +544,9 @@ static int check_vma_flags(struct vm_are + if (vm_flags & (VM_IO | VM_PFNMAP)) + return -EFAULT; + ++ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) ++ return -EFAULT; ++ + if (write) { + if (!(vm_flags & VM_WRITE)) { + if (!(gup_flags & FOLL_FORCE)) diff --git a/queue-4.14/series b/queue-4.14/series index 68e379ba96c..e607b516b47 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -42,3 +42,4 @@ xfrm-use-__skb_queue_tail-in-xfrm_trans_queue.patch btrfs-take-trans-lock-before-access-running-trans-in-check_delayed_ref.patch xfrm-fix-xfrm_do_migrate-with-aead-e.g-aes-gcm.patch l2tp-revert-l2tp-fix-missing-print-session-offset-info.patch +proc-do-not-access-cmdline-nor-environ-from-file-backed-areas.patch