From: Greg Kroah-Hartman Date: Sun, 16 Jul 2023 15:17:34 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.1.39~54 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=38651e6aabc2b51f8f2234af07af5148b183e20f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch --- diff --git a/queue-5.10/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch b/queue-5.10/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch new file mode 100644 index 00000000000..2b2a499306e --- /dev/null +++ b/queue-5.10/fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch @@ -0,0 +1,74 @@ +From 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Thu, 29 Jun 2023 07:20:44 +0300 +Subject: fanotify: disallow mount/sb marks on kernel internal pseudo fs + +From: Amir Goldstein + +commit 69562eb0bd3e6bb8e522a7b254334e0fb30dff0c upstream. + +Hopefully, nobody is trying to abuse mount/sb marks for watching all +anonymous pipes/inodes. + +I cannot think of a good reason to allow this - it looks like an +oversight that dated back to the original fanotify API. + +Link: https://lore.kernel.org/linux-fsdevel/20230628101132.kvchg544mczxv2pm@quack3/ +Fixes: 0ff21db9fcc3 ("fanotify: hooks the fanotify_mark syscall to the vfsmount code") +Signed-off-by: Amir Goldstein +Reviewed-by: Christian Brauner +Signed-off-by: Jan Kara +Message-Id: <20230629042044.25723-1-amir73il@gmail.com> +[backport to 5.x.y] +Signed-off-by: Amir Goldstein +Signed-off-by: Greg Kroah-Hartman +--- + fs/notify/fanotify/fanotify_user.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/fs/notify/fanotify/fanotify_user.c ++++ b/fs/notify/fanotify/fanotify_user.c +@@ -1090,8 +1090,11 @@ static int fanotify_test_fid(struct path + return 0; + } + +-static int fanotify_events_supported(struct path *path, __u64 mask) ++static int fanotify_events_supported(struct path *path, __u64 mask, ++ unsigned int flags) + { ++ unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; ++ + /* + * Some filesystems such as 'proc' acquire unusual locks when opening + * files. For them fanotify permission events have high chances of +@@ -1103,6 +1106,21 @@ static int fanotify_events_supported(str + if (mask & FANOTIFY_PERM_EVENTS && + path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) + return -EINVAL; ++ ++ /* ++ * mount and sb marks are not allowed on kernel internal pseudo fs, ++ * like pipe_mnt, because that would subscribe to events on all the ++ * anonynous pipes in the system. ++ * ++ * SB_NOUSER covers all of the internal pseudo fs whose objects are not ++ * exposed to user's mount namespace, but there are other SB_KERNMOUNT ++ * fs, like nsfs, debugfs, for which the value of allowing sb and mount ++ * mark is questionable. For now we leave them alone. ++ */ ++ if (mark_type != FAN_MARK_INODE && ++ path->mnt->mnt_sb->s_flags & SB_NOUSER) ++ return -EINVAL; ++ + return 0; + } + +@@ -1218,7 +1236,7 @@ static int do_fanotify_mark(int fanotify + goto fput_and_out; + + if (flags & FAN_MARK_ADD) { +- ret = fanotify_events_supported(&path, mask); ++ ret = fanotify_events_supported(&path, mask, flags); + if (ret) + goto path_put_and_out; + } diff --git a/queue-5.10/series b/queue-5.10/series index 31eed7adfa8..42bc36cebbc 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -309,3 +309,4 @@ asoc-mediatek-mt8173-fix-snd_soc_component_initialize-error-path.patch arm-orion5x-fix-d2net-gpio-initialization.patch leds-trigger-netdev-recheck-netdev_led_mode_linkup-on-dev-rename.patch fs-no-need-to-check-source.patch +fanotify-disallow-mount-sb-marks-on-kernel-internal-pseudo-fs.patch