mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 10:49:33 +00:00
coredump: Use the vma snapshot in fill_files_note
commit390031c942
upstream. Matthew Wilcox reported that there is a missing mmap_lock in file_files_note that could possibly lead to a user after free. Solve this by using the existing vma snapshot for consistency and to avoid the need to take the mmap_lock anywhere in the coredump code except for dump_vma_snapshot. Update the dump_vma_snapshot to capture vm_pgoff and vm_file that are neeeded by fill_files_note. Add free_vma_snapshot to free the captured values of vm_file. Reported-by: Matthew Wilcox <willy@infradead.org> Link: https://lkml.kernel.org/r/20220131153740.2396974-1-willy@infradead.org Cc: stable@vger.kernel.org Fixes:a07279c9a8
("binfmt_elf, binfmt_elf_fdpic: use a VMA list snapshot") Fixes:2aa362c49c
("coredump: extend core dump note section to contain file names of mapped files") Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
b7933f145a
commit
558564db44
3 changed files with 35 additions and 13 deletions
|
@ -1613,17 +1613,16 @@ static void fill_siginfo_note(struct memelfnote *note, user_siginfo_t *csigdata,
|
||||||
* long file_ofs
|
* long file_ofs
|
||||||
* followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
|
* followed by COUNT filenames in ASCII: "FILE1" NUL "FILE2" NUL...
|
||||||
*/
|
*/
|
||||||
static int fill_files_note(struct memelfnote *note)
|
static int fill_files_note(struct memelfnote *note, struct coredump_params *cprm)
|
||||||
{
|
{
|
||||||
struct mm_struct *mm = current->mm;
|
|
||||||
struct vm_area_struct *vma;
|
|
||||||
unsigned count, size, names_ofs, remaining, n;
|
unsigned count, size, names_ofs, remaining, n;
|
||||||
user_long_t *data;
|
user_long_t *data;
|
||||||
user_long_t *start_end_ofs;
|
user_long_t *start_end_ofs;
|
||||||
char *name_base, *name_curpos;
|
char *name_base, *name_curpos;
|
||||||
|
int i;
|
||||||
|
|
||||||
/* *Estimated* file count and total data size needed */
|
/* *Estimated* file count and total data size needed */
|
||||||
count = mm->map_count;
|
count = cprm->vma_count;
|
||||||
if (count > UINT_MAX / 64)
|
if (count > UINT_MAX / 64)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
size = count * 64;
|
size = count * 64;
|
||||||
|
@ -1645,11 +1644,12 @@ static int fill_files_note(struct memelfnote *note)
|
||||||
name_base = name_curpos = ((char *)data) + names_ofs;
|
name_base = name_curpos = ((char *)data) + names_ofs;
|
||||||
remaining = size - names_ofs;
|
remaining = size - names_ofs;
|
||||||
count = 0;
|
count = 0;
|
||||||
for (vma = mm->mmap; vma != NULL; vma = vma->vm_next) {
|
for (i = 0; i < cprm->vma_count; i++) {
|
||||||
|
struct core_vma_metadata *m = &cprm->vma_meta[i];
|
||||||
struct file *file;
|
struct file *file;
|
||||||
const char *filename;
|
const char *filename;
|
||||||
|
|
||||||
file = vma->vm_file;
|
file = m->file;
|
||||||
if (!file)
|
if (!file)
|
||||||
continue;
|
continue;
|
||||||
filename = file_path(file, name_curpos, remaining);
|
filename = file_path(file, name_curpos, remaining);
|
||||||
|
@ -1669,9 +1669,9 @@ static int fill_files_note(struct memelfnote *note)
|
||||||
memmove(name_curpos, filename, n);
|
memmove(name_curpos, filename, n);
|
||||||
name_curpos += n;
|
name_curpos += n;
|
||||||
|
|
||||||
*start_end_ofs++ = vma->vm_start;
|
*start_end_ofs++ = m->start;
|
||||||
*start_end_ofs++ = vma->vm_end;
|
*start_end_ofs++ = m->end;
|
||||||
*start_end_ofs++ = vma->vm_pgoff;
|
*start_end_ofs++ = m->pgoff;
|
||||||
count++;
|
count++;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -1682,7 +1682,7 @@ static int fill_files_note(struct memelfnote *note)
|
||||||
* Count usually is less than mm->map_count,
|
* Count usually is less than mm->map_count,
|
||||||
* we need to move filenames down.
|
* we need to move filenames down.
|
||||||
*/
|
*/
|
||||||
n = mm->map_count - count;
|
n = cprm->vma_count - count;
|
||||||
if (n != 0) {
|
if (n != 0) {
|
||||||
unsigned shift_bytes = n * 3 * sizeof(data[0]);
|
unsigned shift_bytes = n * 3 * sizeof(data[0]);
|
||||||
memmove(name_base - shift_bytes, name_base,
|
memmove(name_base - shift_bytes, name_base,
|
||||||
|
@ -1884,7 +1884,7 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
|
||||||
fill_auxv_note(&info->auxv, current->mm);
|
fill_auxv_note(&info->auxv, current->mm);
|
||||||
info->size += notesize(&info->auxv);
|
info->size += notesize(&info->auxv);
|
||||||
|
|
||||||
if (fill_files_note(&info->files) == 0)
|
if (fill_files_note(&info->files, cprm) == 0)
|
||||||
info->size += notesize(&info->files);
|
info->size += notesize(&info->files);
|
||||||
|
|
||||||
return 1;
|
return 1;
|
||||||
|
@ -2073,7 +2073,7 @@ static int fill_note_info(struct elfhdr *elf, int phdrs,
|
||||||
fill_auxv_note(info->notes + 3, current->mm);
|
fill_auxv_note(info->notes + 3, current->mm);
|
||||||
info->numnote = 4;
|
info->numnote = 4;
|
||||||
|
|
||||||
if (fill_files_note(info->notes + info->numnote) == 0) {
|
if (fill_files_note(info->notes + info->numnote, cprm) == 0) {
|
||||||
info->notes_files = info->notes + info->numnote;
|
info->notes_files = info->notes + info->numnote;
|
||||||
info->numnote++;
|
info->numnote++;
|
||||||
}
|
}
|
||||||
|
|
|
@ -54,6 +54,7 @@
|
||||||
#include <trace/events/sched.h>
|
#include <trace/events/sched.h>
|
||||||
|
|
||||||
static bool dump_vma_snapshot(struct coredump_params *cprm);
|
static bool dump_vma_snapshot(struct coredump_params *cprm);
|
||||||
|
static void free_vma_snapshot(struct coredump_params *cprm);
|
||||||
|
|
||||||
int core_uses_pid;
|
int core_uses_pid;
|
||||||
unsigned int core_pipe_limit;
|
unsigned int core_pipe_limit;
|
||||||
|
@ -816,7 +817,7 @@ void do_coredump(const kernel_siginfo_t *siginfo)
|
||||||
file_start_write(cprm.file);
|
file_start_write(cprm.file);
|
||||||
core_dumped = binfmt->core_dump(&cprm);
|
core_dumped = binfmt->core_dump(&cprm);
|
||||||
file_end_write(cprm.file);
|
file_end_write(cprm.file);
|
||||||
kvfree(cprm.vma_meta);
|
free_vma_snapshot(&cprm);
|
||||||
}
|
}
|
||||||
if (ispipe && core_pipe_limit)
|
if (ispipe && core_pipe_limit)
|
||||||
wait_for_dump_helpers(cprm.file);
|
wait_for_dump_helpers(cprm.file);
|
||||||
|
@ -1088,6 +1089,20 @@ static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
|
||||||
return gate_vma;
|
return gate_vma;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void free_vma_snapshot(struct coredump_params *cprm)
|
||||||
|
{
|
||||||
|
if (cprm->vma_meta) {
|
||||||
|
int i;
|
||||||
|
for (i = 0; i < cprm->vma_count; i++) {
|
||||||
|
struct file *file = cprm->vma_meta[i].file;
|
||||||
|
if (file)
|
||||||
|
fput(file);
|
||||||
|
}
|
||||||
|
kvfree(cprm->vma_meta);
|
||||||
|
cprm->vma_meta = NULL;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Under the mmap_lock, take a snapshot of relevant information about the task's
|
* Under the mmap_lock, take a snapshot of relevant information about the task's
|
||||||
* VMAs.
|
* VMAs.
|
||||||
|
@ -1124,6 +1139,11 @@ static bool dump_vma_snapshot(struct coredump_params *cprm)
|
||||||
m->end = vma->vm_end;
|
m->end = vma->vm_end;
|
||||||
m->flags = vma->vm_flags;
|
m->flags = vma->vm_flags;
|
||||||
m->dump_size = vma_dump_size(vma, cprm->mm_flags);
|
m->dump_size = vma_dump_size(vma, cprm->mm_flags);
|
||||||
|
m->pgoff = vma->vm_pgoff;
|
||||||
|
|
||||||
|
m->file = vma->vm_file;
|
||||||
|
if (m->file)
|
||||||
|
get_file(m->file);
|
||||||
}
|
}
|
||||||
|
|
||||||
mmap_write_unlock(mm);
|
mmap_write_unlock(mm);
|
||||||
|
|
|
@ -11,6 +11,8 @@ struct core_vma_metadata {
|
||||||
unsigned long start, end;
|
unsigned long start, end;
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
unsigned long dump_size;
|
unsigned long dump_size;
|
||||||
|
unsigned long pgoff;
|
||||||
|
struct file *file;
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
Loading…
Reference in a new issue