From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S938613AbcLOQcH (ORCPT ); Thu, 15 Dec 2016 11:32:07 -0500 Received: from mx2.suse.de ([195.135.220.15]:40513 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935112AbcLOQcF (ORCPT ); Thu, 15 Dec 2016 11:32:05 -0500 Date: Thu, 15 Dec 2016 17:32:02 +0100 From: Jan Kara To: Mark Salyzyn Cc: Greg KH , Cong Wang , LKML , aneesh.kumar@linux.vnet.ibm.com, Jan Kara Subject: Re: CVE-2016-7097 causes acl leak Message-ID: <20161215163202.GG13811@quack2.suse.cz> References: <3a180415-2f02-c9c0-e1e6-519b5d3115b7@android.com> <5c0398cb-9ef2-42f3-0c46-e2e65fe92da9@android.com> <20161214000005.GA29963@kroah.com> <3db72683-e810-38f8-87c8-dc7fa6a50aa6@android.com> <20161214233006.GB24234@kroah.com> <1a0f7aa9-baa9-29de-3d2d-1abc637c1b7b@android.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1a0f7aa9-baa9-29de-3d2d-1abc637c1b7b@android.com> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu 15-12-16 07:22:30, Mark Salyzyn wrote: > On 12/14/2016 03:30 PM, Greg KH wrote: > >On Wed, Dec 14, 2016 at 12:20:50PM -0800, Mark Salyzyn wrote: > >>On 12/13/2016 04:00 PM, Greg KH wrote: > >>>On Tue, Dec 13, 2016 at 03:42:58PM -0800, Mark Salyzyn wrote: > >>>>On 12/12/2016 10:26 PM, Cong Wang wrote: > >>>>>On Mon, Dec 12, 2016 at 4:26 PM, Mark Salyzyn wrote: > >>>>>>The leaks were introduced in 9p, gfs2, jfs and xfs drivers only. > >>>>>Only the 9p case is obvious to me: > >>>>> > >>>>>diff --git a/fs/9p/acl.c b/fs/9p/acl.c > >>>>>index b3c2cc7..082d227 100644 > >>>>>--- a/fs/9p/acl.c > >>>>>+++ b/fs/9p/acl.c > >>>>>@@ -277,6 +277,7 @@ static int v9fs_xattr_set_acl(const struct > >>>>>xattr_handler *handler, > >>>>> case ACL_TYPE_ACCESS: > >>>>> if (acl) { > >>>>> struct iattr iattr; > >>>>>+ struct posix_acl *old_acl = acl; > >>>>> > >>>>> retval = posix_acl_update_mode(inode, > >>>>>&iattr.ia_mode, &acl); > >>>>> if (retval) > >>>>>@@ -287,6 +288,7 @@ static int v9fs_xattr_set_acl(const struct > >>>>>xattr_handler *handler, > >>>>> * by the mode bits. So don't > >>>>> * update ACL. > >>>>> */ > >>>>>+ posix_acl_release(old_acl); > >>>>> value = NULL; > >>>>> size = 0; > >>>>> } > >>>>> > >>>>> > >>>>>The rest are anti-pattern (modifying parameters on stack via address) > >>>>>but look correct. > >>>>Greg KH: Beware that this similar fix needs to be applied to _backports_ to > >>>>stable kernel trees on other filesystem driver that have the same pattern > >>>>(with local posix_acl_release(acl) calls). I have found that depending on > >>>>vintage these would include this driver 9p, and possibly gfs2, jfs and xfs. > >>>>Be aware. > >>>I don't understand what you mean here. What needs to be "backported" to > >>>the stable tree? What commit in Linus's tree do I pick? If not a > >>>commit there, where is it? > >>> > >>>totally confused, > >>> > >>>greg k-h > >>In 3.10-stable if you took the original CVE-2016-7097 fix it could break > >>four file system drivers, the fix for each would 'look like' this one fix > >>for the 9p driver. > >Did I take the fix in 3.10-stable? What was the git commit id? Is 3.10 > >"broken" in this way? Is any other stable kernel broken? > > > >I still don't have any idea of what is going on here... > > > >greg k-h > > Nothing is going on here, it is a heads up, eventually CVE's get backported > to stable as we do take them in through those paths. Telling you to be aware > that the original commit causes a leak, and my experience has found that the > leak affects these four file system drivers. Original commit (073931017b49) fixing the CVE does not contain the leak. The leak in 9p was there before that commit. But yes, a naive backport of that commit into 3.10 will introduce new similar leaks into xfs and others. Honza -- Jan Kara SUSE Labs, CR