From: Greg Kroah-Hartman Date: Sun, 16 Jul 2023 15:17:17 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v6.1.39~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2f4419b8e222eef113cb377f2f930d63f8dfce03;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch --- diff --git a/queue-5.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch b/queue-5.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch new file mode 100644 index 00000000000..d1e1bd5699a --- /dev/null +++ b/queue-5.4/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch @@ -0,0 +1,74 @@ +From 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Thu, 29 Jun 2023 07:20:44 +0300 +Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs + +From: Amir Goldstein + +commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c upstream. + +Hopefully, nobody is trying to abuse mount/sb marks for watching all +anonymous pipes/inodes. + +I cannot think of a good reason to allow this - it looks like an +oversight that dated back to the original fanotify API. + +Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ +Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") +Signed-off-by: Amir Goldstein +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Message-Id: <20230629042044.25723-1-amir73il@gmail.com> +[backport to 5.x.y] +Signed-off-by: Amir Goldstein +Signed-off-by: Greg Kroah-Hartman +--- + fs/notify/fanotify/fanotify_user.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -928,8 +928,11 @@ static int fanotify_test_fid(struct path + return 0; + } + +-static int fanotify_events_supported(struct path *path, __u64 mask) ++static int fanotify_events_supported(struct path *path, __u64 mask, ++ unsigned int flags) + { ++ unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; ++ + /* + * Some filesystems such as 'proc' acquire unusual locks when opening + * files. For them fanotify permission events have high chances of +@@ -941,6 +944,21 @@ static int fanotify_events_supported(str + if (mask & FANOTIFY_PERM_EVENTS && + path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) + return -EINVAL; ++ ++ /* ++ * mount and sb marks are not allowed on kernel internal pseudo fs, ++ * like pipe_mnt, because that would subscribe to events on all the ++ * anonynous pipes in the system. ++ * ++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not ++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT ++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount ++ * mark is questionable. For now we leave them alone. ++ */ ++ if (mark_type != FAN_MARK_INODE && ++ path->mnt->mnt_sb->s_flags & SB_NOUSER) ++ return -EINVAL; ++ + return 0; + } + +@@ -1050,7 +1068,7 @@ static int do_fanotify_mark(int fanotify + goto fput_and_out; + + if (flags & FAN_MARK_ADD) { +- ret = fanotify_events_supported(&path, mask); ++ ret = fanotify_events_supported(&path, mask, flags); + if (ret) + goto path_put_and_out; + } diff --git a/queue-5.4/series b/queue-5.4/series index 56c0471bdce..a9c045b6d2b 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -178,4 +178,5 @@ btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch asoc-mediatek-mt8173-fix-irq-error-path.patch arm-orion5x-fix-d2net-gpio-initialization.patch fs-no-need-to-check-source.patch +fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch mm-mmap-fix-extra-maple-tree-write.patch