Commit 4def1963 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'userns-linus' of...

Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull namespace fixes from Eric Biederman:
 "This is a set of four fairly obvious bug fixes:

   - a switch from d_find_alias to d_find_any_alias because the xattr
     code perversely takes a dentry

   - two mutex vs copy_to_user fixes from Jann Horn

   - a fix to use a sanitized size not the size userspace passed in from
     Christian Brauner"

* 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  getxattr: use correct xattr length
  sys: don't hold uts_sem while accessing userspace memory
  userns: move user access out of the mutex
  cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
parents 5e8704ac 82c9a927
...@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path, ...@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path,
SYSCALL_DEFINE1(osf_utsname, char __user *, name) SYSCALL_DEFINE1(osf_utsname, char __user *, name)
{ {
int error; int error;
char tmp[5 * 32];
down_read(&uts_sem); down_read(&uts_sem);
error = -EFAULT; memcpy(tmp + 0 * 32, utsname()->sysname, 32);
if (copy_to_user(name + 0, utsname()->sysname, 32)) memcpy(tmp + 1 * 32, utsname()->nodename, 32);
goto out; memcpy(tmp + 2 * 32, utsname()->release, 32);
if (copy_to_user(name + 32, utsname()->nodename, 32)) memcpy(tmp + 3 * 32, utsname()->version, 32);
goto out; memcpy(tmp + 4 * 32, utsname()->machine, 32);
if (copy_to_user(name + 64, utsname()->release, 32))
goto out;
if (copy_to_user(name + 96, utsname()->version, 32))
goto out;
if (copy_to_user(name + 128, utsname()->machine, 32))
goto out;
error = 0;
out:
up_read(&uts_sem); up_read(&uts_sem);
return error;
if (copy_to_user(name, tmp, sizeof(tmp)))
return -EFAULT;
return 0;
} }
SYSCALL_DEFINE0(getpagesize) SYSCALL_DEFINE0(getpagesize)
...@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) ...@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen)
{ {
int len, err = 0; int len, err = 0;
char *kname; char *kname;
char tmp[32];
if (namelen > 32) if (namelen < 0 || namelen > 32)
namelen = 32; namelen = 32;
down_read(&uts_sem); down_read(&uts_sem);
kname = utsname()->domainname; kname = utsname()->domainname;
len = strnlen(kname, namelen); len = strnlen(kname, namelen);
if (copy_to_user(name, kname, min(len + 1, namelen))) len = min(len + 1, namelen);
err = -EFAULT; memcpy(tmp, kname, len);
up_read(&uts_sem); up_read(&uts_sem);
return err; if (copy_to_user(name, tmp, len))
return -EFAULT;
return 0;
} }
/* /*
...@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) ...@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
}; };
unsigned long offset; unsigned long offset;
const char *res; const char *res;
long len, err = -EINVAL; long len;
char tmp[__NEW_UTS_LEN + 1];
offset = command-1; offset = command-1;
if (offset >= ARRAY_SIZE(sysinfo_table)) { if (offset >= ARRAY_SIZE(sysinfo_table)) {
/* Digital UNIX has a few unpublished interfaces here */ /* Digital UNIX has a few unpublished interfaces here */
printk("sysinfo(%d)", command); printk("sysinfo(%d)", command);
goto out; return -EINVAL;
} }
down_read(&uts_sem); down_read(&uts_sem);
...@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) ...@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
len = strlen(res)+1; len = strlen(res)+1;
if ((unsigned long)len > (unsigned long)count) if ((unsigned long)len > (unsigned long)count)
len = count; len = count;
if (copy_to_user(buf, res, len)) memcpy(tmp, res, len);
err = -EFAULT;
else
err = 0;
up_read(&uts_sem); up_read(&uts_sem);
out: if (copy_to_user(buf, tmp, len))
return err; return -EFAULT;
return 0;
} }
SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer, SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,
......
...@@ -198,6 +198,7 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, ...@@ -198,6 +198,7 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig,
SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
{ {
int nlen, err; int nlen, err;
char tmp[__NEW_UTS_LEN + 1];
if (len < 0) if (len < 0)
return -EINVAL; return -EINVAL;
...@@ -207,13 +208,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) ...@@ -207,13 +208,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
nlen = strlen(utsname()->domainname) + 1; nlen = strlen(utsname()->domainname) + 1;
err = -EINVAL; err = -EINVAL;
if (nlen > len) if (nlen > len)
goto out; goto out_unlock;
memcpy(tmp, utsname()->domainname, nlen);
err = -EFAULT; up_read(&uts_sem);
if (!copy_to_user(name, utsname()->domainname, nlen))
err = 0;
out: if (copy_to_user(name, tmp, nlen))
return -EFAULT;
return 0;
out_unlock:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
...@@ -520,6 +520,7 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs) ...@@ -520,6 +520,7 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs)
SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
{ {
int nlen, err; int nlen, err;
char tmp[__NEW_UTS_LEN + 1];
if (len < 0) if (len < 0)
return -EINVAL; return -EINVAL;
...@@ -529,13 +530,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) ...@@ -529,13 +530,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
nlen = strlen(utsname()->domainname) + 1; nlen = strlen(utsname()->domainname) + 1;
err = -EINVAL; err = -EINVAL;
if (nlen > len) if (nlen > len)
goto out; goto out_unlock;
memcpy(tmp, utsname()->domainname, nlen);
err = -EFAULT; up_read(&uts_sem);
if (!copy_to_user(name, utsname()->domainname, nlen))
err = 0;
out: if (copy_to_user(name, tmp, nlen))
return -EFAULT;
return 0;
out_unlock:
up_read(&uts_sem); up_read(&uts_sem);
return err; return err;
} }
......
...@@ -538,7 +538,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, ...@@ -538,7 +538,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
if (error > 0) { if (error > 0) {
if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) || if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
(strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0)) (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
posix_acl_fix_xattr_to_user(kvalue, size); posix_acl_fix_xattr_to_user(kvalue, error);
if (size && copy_to_user(value, kvalue, error)) if (size && copy_to_user(value, kvalue, error))
error = -EFAULT; error = -EFAULT;
} else if (error == -ERANGE && size >= XATTR_SIZE_MAX) { } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
......
...@@ -1237,18 +1237,19 @@ static int override_release(char __user *release, size_t len) ...@@ -1237,18 +1237,19 @@ static int override_release(char __user *release, size_t len)
SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
{ {
int errno = 0; struct new_utsname tmp;
down_read(&uts_sem); down_read(&uts_sem);
if (copy_to_user(name, utsname(), sizeof *name)) memcpy(&tmp, utsname(), sizeof(tmp));
errno = -EFAULT;
up_read(&uts_sem); up_read(&uts_sem);
if (copy_to_user(name, &tmp, sizeof(tmp)))
return -EFAULT;
if (!errno && override_release(name->release, sizeof(name->release))) if (override_release(name->release, sizeof(name->release)))
errno = -EFAULT; return -EFAULT;
if (!errno && override_architecture(name)) if (override_architecture(name))
errno = -EFAULT; return -EFAULT;
return errno; return 0;
} }
#ifdef __ARCH_WANT_SYS_OLD_UNAME #ifdef __ARCH_WANT_SYS_OLD_UNAME
...@@ -1257,55 +1258,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) ...@@ -1257,55 +1258,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
*/ */
SYSCALL_DEFINE1(uname, struct old_utsname __user *, name) SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
{ {
int error = 0; struct old_utsname tmp;
if (!name) if (!name)
return -EFAULT; return -EFAULT;
down_read(&uts_sem); down_read(&uts_sem);
if (copy_to_user(name, utsname(), sizeof(*name))) memcpy(&tmp, utsname(), sizeof(tmp));
error = -EFAULT;
up_read(&uts_sem); up_read(&uts_sem);
if (copy_to_user(name, &tmp, sizeof(tmp)))
return -EFAULT;
if (!error && override_release(name->release, sizeof(name->release))) if (override_release(name->release, sizeof(name->release)))
error = -EFAULT; return -EFAULT;
if (!error && override_architecture(name)) if (override_architecture(name))
error = -EFAULT; return -EFAULT;
return error; return 0;
} }
SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
{ {
int error; struct oldold_utsname tmp = {};
if (!name) if (!name)
return -EFAULT; return -EFAULT;
if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname)))
return -EFAULT;
down_read(&uts_sem); down_read(&uts_sem);
error = __copy_to_user(&name->sysname, &utsname()->sysname, memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
__OLD_UTS_LEN); memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
error |= __put_user(0, name->sysname + __OLD_UTS_LEN); memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN);
error |= __copy_to_user(&name->nodename, &utsname()->nodename, memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN);
__OLD_UTS_LEN); memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN);
error |= __put_user(0, name->nodename + __OLD_UTS_LEN);
error |= __copy_to_user(&name->release, &utsname()->release,
__OLD_UTS_LEN);
error |= __put_user(0, name->release + __OLD_UTS_LEN);
error |= __copy_to_user(&name->version, &utsname()->version,
__OLD_UTS_LEN);
error |= __put_user(0, name->version + __OLD_UTS_LEN);
error |= __copy_to_user(&name->machine, &utsname()->machine,
__OLD_UTS_LEN);
error |= __put_user(0, name->machine + __OLD_UTS_LEN);
up_read(&uts_sem); up_read(&uts_sem);
if (copy_to_user(name, &tmp, sizeof(tmp)))
return -EFAULT;
if (!error && override_architecture(name)) if (override_architecture(name))
error = -EFAULT; return -EFAULT;
if (!error && override_release(name->release, sizeof(name->release))) if (override_release(name->release, sizeof(name->release)))
error = -EFAULT; return -EFAULT;
return error ? -EFAULT : 0; return 0;
} }
#endif #endif
...@@ -1319,17 +1311,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) ...@@ -1319,17 +1311,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
if (len < 0 || len > __NEW_UTS_LEN) if (len < 0 || len > __NEW_UTS_LEN)
return -EINVAL; return -EINVAL;
down_write(&uts_sem);
errno = -EFAULT; errno = -EFAULT;
if (!copy_from_user(tmp, name, len)) { if (!copy_from_user(tmp, name, len)) {
struct new_utsname *u = utsname(); struct new_utsname *u;
down_write(&uts_sem);
u = utsname();
memcpy(u->nodename, tmp, len); memcpy(u->nodename, tmp, len);
memset(u->nodename + len, 0, sizeof(u->nodename) - len); memset(u->nodename + len, 0, sizeof(u->nodename) - len);
errno = 0; errno = 0;
uts_proc_notify(UTS_PROC_HOSTNAME); uts_proc_notify(UTS_PROC_HOSTNAME);
}
up_write(&uts_sem); up_write(&uts_sem);
}
return errno; return errno;
} }
...@@ -1337,8 +1330,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) ...@@ -1337,8 +1330,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len)
SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
{ {
int i, errno; int i;
struct new_utsname *u; struct new_utsname *u;
char tmp[__NEW_UTS_LEN + 1];
if (len < 0) if (len < 0)
return -EINVAL; return -EINVAL;
...@@ -1347,11 +1341,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) ...@@ -1347,11 +1341,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)
i = 1 + strlen(u->nodename); i = 1 + strlen(u->nodename);
if (i > len) if (i > len)
i = len; i = len;
errno = 0; memcpy(tmp, u->nodename, i);
if (copy_to_user(name, u->nodename, i))
errno = -EFAULT;
up_read(&uts_sem); up_read(&uts_sem);
return errno; if (copy_to_user(name, tmp, i))
return -EFAULT;
return 0;
} }
#endif #endif
...@@ -1370,17 +1364,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len) ...@@ -1370,17 +1364,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len)
if (len < 0 || len > __NEW_UTS_LEN) if (len < 0 || len > __NEW_UTS_LEN)
return -EINVAL; return -EINVAL;
down_write(&uts_sem);
errno = -EFAULT; errno = -EFAULT;
if (!copy_from_user(tmp, name, len)) { if (!copy_from_user(tmp, name, len)) {
struct new_utsname *u = utsname(); struct new_utsname *u;
down_write(&uts_sem);
u = utsname();
memcpy(u->domainname, tmp, len); memcpy(u->domainname, tmp, len);
memset(u->domainname + len, 0, sizeof(u->domainname) - len); memset(u->domainname + len, 0, sizeof(u->domainname) - len);
errno = 0; errno = 0;
uts_proc_notify(UTS_PROC_DOMAINNAME); uts_proc_notify(UTS_PROC_DOMAINNAME);
}
up_write(&uts_sem); up_write(&uts_sem);
}
return errno; return errno;
} }
......
...@@ -859,7 +859,16 @@ static ssize_t map_write(struct file *file, const char __user *buf, ...@@ -859,7 +859,16 @@ static ssize_t map_write(struct file *file, const char __user *buf,
unsigned idx; unsigned idx;
struct uid_gid_extent extent; struct uid_gid_extent extent;
char *kbuf = NULL, *pos, *next_line; char *kbuf = NULL, *pos, *next_line;
ssize_t ret = -EINVAL; ssize_t ret;
/* Only allow < page size writes at the beginning of the file */
if ((*ppos != 0) || (count >= PAGE_SIZE))
return -EINVAL;
/* Slurp in the user data */
kbuf = memdup_user_nul(buf, count);
if (IS_ERR(kbuf))
return PTR_ERR(kbuf);
/* /*
* The userns_state_mutex serializes all writes to any given map. * The userns_state_mutex serializes all writes to any given map.
...@@ -895,19 +904,6 @@ static ssize_t map_write(struct file *file, const char __user *buf, ...@@ -895,19 +904,6 @@ static ssize_t map_write(struct file *file, const char __user *buf,
if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN)) if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
goto out; goto out;
/* Only allow < page size writes at the beginning of the file */
ret = -EINVAL;
if ((*ppos != 0) || (count >= PAGE_SIZE))
goto out;
/* Slurp in the user data */
kbuf = memdup_user_nul(buf, count);
if (IS_ERR(kbuf)) {
ret = PTR_ERR(kbuf);
kbuf = NULL;
goto out;
}
/* Parse the user data */ /* Parse the user data */
ret = -EINVAL; ret = -EINVAL;
pos = kbuf; pos = kbuf;
......
...@@ -18,7 +18,7 @@ ...@@ -18,7 +18,7 @@
#ifdef CONFIG_PROC_SYSCTL #ifdef CONFIG_PROC_SYSCTL
static void *get_uts(struct ctl_table *table, int write) static void *get_uts(struct ctl_table *table)
{ {
char *which = table->data; char *which = table->data;
struct uts_namespace *uts_ns; struct uts_namespace *uts_ns;
...@@ -26,21 +26,9 @@ static void *get_uts(struct ctl_table *table, int write) ...@@ -26,21 +26,9 @@ static void *get_uts(struct ctl_table *table, int write)
uts_ns = current->nsproxy->uts_ns; uts_ns = current->nsproxy->uts_ns;
which = (which - (char *)&init_uts_ns) + (char *)uts_ns; which = (which - (char *)&init_uts_ns) + (char *)uts_ns;
if (!write)
down_read(&uts_sem);
else
down_write(&uts_sem);
return which; return which;
} }
static void put_uts(struct ctl_table *table, int write, void *which)
{
if (!write)
up_read(&uts_sem);
else
up_write(&uts_sem);
}
/* /*
* Special case of dostring for the UTS structure. This has locks * Special case of dostring for the UTS structure. This has locks
* to observe. Should this be in kernel/sys.c ???? * to observe. Should this be in kernel/sys.c ????
...@@ -50,13 +38,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write, ...@@ -50,13 +38,34 @@ static int proc_do_uts_string(struct ctl_table *table, int write,
{ {
struct ctl_table uts_table; struct ctl_table uts_table;
int r; int r;
char tmp_data[__NEW_UTS_LEN + 1];
memcpy(&uts_table, table, sizeof(uts_table)); memcpy(&uts_table, table, sizeof(uts_table));
uts_table.data = get_uts(table, write); uts_table.data = tmp_data;
/*
* Buffer the value in tmp_data so that proc_dostring() can be called
* without holding any locks.
* We also need to read the original value in the write==1 case to
* support partial writes.
*/
down_read(&uts_sem);
memcpy(tmp_data, get_uts(table), sizeof(tmp_data));
up_read(&uts_sem);
r = proc_dostring(&uts_table, write, buffer, lenp, ppos); r = proc_dostring(&uts_table, write, buffer, lenp, ppos);
put_uts(table, write, uts_table.data);
if (write) if (write) {
/*
* Write back the new value.
* Note that, since we dropped uts_sem, the result can
* theoretically be incorrect if there are two parallel writes
* at non-zero offsets to the same sysctl.
*/
down_write(&uts_sem);
memcpy(get_uts(table), tmp_data, sizeof(tmp_data));
up_write(&uts_sem);
proc_sys_poll_notify(table->poll); proc_sys_poll_notify(table->poll);
}
return r; return r;
} }
......
...@@ -388,7 +388,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer, ...@@ -388,7 +388,7 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
if (strcmp(name, "capability") != 0) if (strcmp(name, "capability") != 0)
return -EOPNOTSUPP; return -EOPNOTSUPP;
dentry = d_find_alias(inode); dentry = d_find_any_alias(inode);
if (!dentry) if (!dentry)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment