Commit aa51d1c2 authored by willy tarreau's avatar willy tarreau Committed by Greg Kroah-Hartman

unix: properly account for FDs passed over unix sockets

[ Upstream commit 712f4aad ]

It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.

This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.

Reported-by: socketpair@gmail.com
Reported-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 408566c5
...@@ -755,6 +755,7 @@ struct user_struct { ...@@ -755,6 +755,7 @@ struct user_struct {
unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */ unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
#endif #endif
unsigned long locked_shm; /* How many pages of mlocked shm ? */ unsigned long locked_shm; /* How many pages of mlocked shm ? */
unsigned long unix_inflight; /* How many files in flight in unix sockets */
#ifdef CONFIG_KEYS #ifdef CONFIG_KEYS
struct key *uid_keyring; /* UID specific keyring */ struct key *uid_keyring; /* UID specific keyring */
......
...@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_buff *skb) ...@@ -1486,6 +1486,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
sock_wfree(skb); sock_wfree(skb);
} }
/*
* The "user->unix_inflight" variable is protected by the garbage
* collection lock, and we just read it locklessly here. If you go
* over the limit, there might be a tiny race in actually noticing
* it across threads. Tough.
*/
static inline bool too_many_unix_fds(struct task_struct *p)
{
struct user_struct *user = current_user();
if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
return false;
}
#define MAX_RECURSION_LEVEL 4 #define MAX_RECURSION_LEVEL 4
static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
...@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) ...@@ -1494,6 +1509,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
unsigned char max_level = 0; unsigned char max_level = 0;
int unix_sock_count = 0; int unix_sock_count = 0;
if (too_many_unix_fds(current))
return -ETOOMANYREFS;
for (i = scm->fp->count - 1; i >= 0; i--) { for (i = scm->fp->count - 1; i >= 0; i--) {
struct sock *sk = unix_get_socket(scm->fp->fp[i]); struct sock *sk = unix_get_socket(scm->fp->fp[i]);
...@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) ...@@ -1515,10 +1533,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
if (!UNIXCB(skb).fp) if (!UNIXCB(skb).fp)
return -ENOMEM; return -ENOMEM;
if (unix_sock_count) { for (i = scm->fp->count - 1; i >= 0; i--)
for (i = scm->fp->count - 1; i >= 0; i--) unix_inflight(scm->fp->fp[i]);
unix_inflight(scm->fp->fp[i]);
}
return max_level; return max_level;
} }
......
...@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp) ...@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp)
void unix_inflight(struct file *fp) void unix_inflight(struct file *fp)
{ {
struct sock *s = unix_get_socket(fp); struct sock *s = unix_get_socket(fp);
spin_lock(&unix_gc_lock);
if (s) { if (s) {
struct unix_sock *u = unix_sk(s); struct unix_sock *u = unix_sk(s);
spin_lock(&unix_gc_lock);
if (atomic_long_inc_return(&u->inflight) == 1) { if (atomic_long_inc_return(&u->inflight) == 1) {
BUG_ON(!list_empty(&u->link)); BUG_ON(!list_empty(&u->link));
list_add_tail(&u->link, &gc_inflight_list); list_add_tail(&u->link, &gc_inflight_list);
...@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp) ...@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp)
BUG_ON(list_empty(&u->link)); BUG_ON(list_empty(&u->link));
} }
unix_tot_inflight++; unix_tot_inflight++;
spin_unlock(&unix_gc_lock);
} }
fp->f_cred->user->unix_inflight++;
spin_unlock(&unix_gc_lock);
} }
void unix_notinflight(struct file *fp) void unix_notinflight(struct file *fp)
{ {
struct sock *s = unix_get_socket(fp); struct sock *s = unix_get_socket(fp);
spin_lock(&unix_gc_lock);
if (s) { if (s) {
struct unix_sock *u = unix_sk(s); struct unix_sock *u = unix_sk(s);
spin_lock(&unix_gc_lock);
BUG_ON(list_empty(&u->link)); BUG_ON(list_empty(&u->link));
if (atomic_long_dec_and_test(&u->inflight)) if (atomic_long_dec_and_test(&u->inflight))
list_del_init(&u->link); list_del_init(&u->link);
unix_tot_inflight--; unix_tot_inflight--;
spin_unlock(&unix_gc_lock);
} }
fp->f_cred->user->unix_inflight--;
spin_unlock(&unix_gc_lock);
} }
static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *), static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment