From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932878AbcHCVIj (ORCPT ); Wed, 3 Aug 2016 17:08:39 -0400 Received: from thejh.net ([37.221.195.125]:47891 "EHLO thejh.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758352AbcHCVIQ (ORCPT ); Wed, 3 Aug 2016 17:08:16 -0400 Date: Wed, 3 Aug 2016 22:43:54 +0200 From: Jann Horn To: Joe Korty Cc: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] fix mm_access bug in pagemap_read Message-ID: <20160803204354.GA12989@pc.thejh.net> References: <20160802192653.GA2953@zipoli.ccur.com> <20160802214048.GA9770@pc.thejh.net> <20160803185830.GA26952@zipoli.ccur.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="MGYHOYXEY6WxJCY8" Content-Disposition: inline In-Reply-To: <20160803185830.GA26952@zipoli.ccur.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --MGYHOYXEY6WxJCY8 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Aug 03, 2016 at 02:58:30PM -0400, Joe Korty wrote: > On Tue, Aug 02, 2016 at 05:40:48PM -0400, Jann Horn wrote: > > On Tue, Aug 02, 2016 at 03:26:53PM -0400, Joe Korty wrote: > > > Hi Jann, > > > The following linux-4.1.y git commit, y > 17, > > >=20 > > > Commit caaee6234d05a58c5b4d05e7bf766131b810a657 > > > Author: Jann Horn > > > Date: Wed Jan 20 15:00:04 2016 -0800 > > >=20 > > > ptrace: use fsuid, fsgid, effective creds for fs access checks > > >=20 > > > broke linux-4.1.y with the following oops, repeated forever. > >=20 > > > [ 81.122531] ------------[ cut here ]------------ > > > [ 81.127161] WARNING: CPU: 6 PID: 5553 at kernel/ptrace.c:248 __= ptrace_may_access+0x18a/0x1a0() > > > [ 81.135780] denying ptrace access check without PTRACE_MODE_*CR= EDS > >=20 > > (Nit: That's just a warning, not an oops - it blocks access, but > > doesn't kill the calling process. But still not good, of course.) > >=20 > >=20 > > > The problem is that the above git commit missed one mm_access call > > > that needed converting. In this patch, we convert PTRACE_MODE_READ > > > to PTRACE_MODE_READ_FSCREDS as that seems more correct for pagemap_re= ad > > > than PTRACE_MODE_READ_REALCREDS. > >=20 > > Yup, PTRACE_MODE_READ_FSCREDS is appropriate here. > >=20 > >=20 > > > There may be stable releases other than linux-4.1.y that need this fi= x. > > >=20 > > > Signed-off-by: Joe Korty > > >=20 > > > Index: b/fs/proc/task_mmu.c > > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > > > --- a/fs/proc/task_mmu.c > > > +++ b/fs/proc/task_mmu.c > > > @@ -1257,7 +1257,7 @@ static ssize_t pagemap_read(struct file=20 > > > if (!pm.buffer) > > > goto out_task; > > > =20 > > > - mm =3D mm_access(task, PTRACE_MODE_READ); > > > + mm =3D mm_access(task, PTRACE_MODE_READ_FSCREDS); > > > ret =3D PTR_ERR(mm); > > > if (!mm || IS_ERR(mm)) > > > goto out_free; > >=20 >=20 >=20 > Hi Jann, > Greg may need an 'Acked-by' from you before he can apply this fix. Ah, okay. Sure, you can add: Acked-by: Jann Horn > Greg, I just looked at the longterm and the 4.7 releases and it > appears that only 4.1 and 3.18 need this fix. --MGYHOYXEY6WxJCY8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJXoleKAAoJED4KNFJOeCOoK5sP/3AoKdNoULrIuoKQAEWzvz5K 8D7c7LWqShn6hBFJddr7YUND9zC5WNlzeGx0XFxbYVOcWeVjUa3aytIIMSW0PKTm YA/IQdwW0FVxi0ElP2FWf5QME0aI1Wvx1jeJvsIN8cpFhaAiURS4NG40cFo1Ryes xQjzh41iRey0hPcK49mtJGwd5X420F5BbHgbwjt1JFXvVGQi3tfDqUQemLHpGuMO Vheb7FyG1AMScecjlfZgEXge6vp8aLwPT3kEFmmitEYbepfQTJ8nQRHy5TEfFnDv H4BKk/IaXrn2L7QMiDWYnuMBcV8OFlPq66C+DN/UK4miDUtvDx6KuBDiufCfjQ2P CR9zQAdYgDa9l1PqY+HuB1EkPVlvqkjxnj8bVUeIXGjxqSW0bHDeqx1Bx2DHtiKt s3j8bUulv961f01p5w9SbHbWMUUKRg8xwXLcFd4FmVebuMJWB12GSbadPS1m2UJx bDfrvznE3O4/7WLRFd45a80tdpva4BUkQw14EGWyG5xc7QcnQWPwPeLatE3diuXu 0LgsgKFgzDKYvTH8CB3kZSuGLRZ4Sb1tQB1kMMMF/jpLz695j6ODKog4F9ln1nPh SRHHnEu7SPvVCFNqW1yCK7JNBof9kpoBXLj2Gbd+2zEpUWmPtITn5UajGM0aEblh V4dMA7ZCNQiHDILMP/ni =7MKv -----END PGP SIGNATURE----- --MGYHOYXEY6WxJCY8--