Received: by 2002:a25:824b:0:0:0:0:0 with SMTP id d11csp1195287ybn; Wed, 2 Oct 2019 12:15:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqyxwGEFD+em+uZUvOWjJ+QvPPXJlY8POGO+rAyXfX9IU53Iapa7BIeMczzPadCg2+tZDFum X-Received: by 2002:aa7:d688:: with SMTP id d8mr5622544edr.156.1570043734426; Wed, 02 Oct 2019 12:15:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570043734; cv=none; d=google.com; s=arc-20160816; b=ayzfPF/BCj3ngYFnAsZmr8Lb+UvkHbd9i4xvVrFvrgRdCB7kYHzOdCHEheY2eD7ZJf 9TyFA9dwqWSiM9eOltt6V+3f4hbs1QX/ib5m8OZLp8rQZj3IRVVXzPgknWiGfB6iZ4X6 xF62TxHMhYDDpLX8EX/K/QHlAOrA5XejcTRnYcqEopsg+rp92JMBZtk9k778AtPL/YA8 0q1soWK3/VvrQrLxKqdTPmpHqtCJDswny2Xcd0GNY+Gx+D5Oaf4vaBAq8lzmrniezsYE oCRldv21yV5lrSOdqPZb2RNE3NPL8V7y/Uqz8fTAomKFAzm6nJFCLcRgu0y+tTTa5kfL TBEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition; bh=LrEYBJ6iKEcYgdNBYnDwvHlbM3ve24ky/VLZyHFT8tM=; b=uG1mAqmi+JMo3ToldKSSQ+pS/Oj1HD1XLX0jiBfrQ8svAXRdyHcJX9BNL00bwzBUNu JzPoKlbUSL2puymAkO9+n6mAfISyYhGW8ySi5GZm3qDaoBIf2blvaB2edErhwbw57n07 o80P9+U81PJ66oIdv0oobg0n+8VXYPzIjTN96o7TD5tWg+xzgW2oPKxPUcBaSqUOvA55 rDdRo1nlzrRvBIgq1Q64MQb534aQFqt5J6JwGVxQPRZAnFO21sWnBpjXwcelhgplv3b0 j0CMdmTgef86ZBvc87nG72wI7P+29+trnpCPxTty9iIQhwrKxD0xf4R5ack+CO4a2bX6 8cag== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id w23si8479ejj.214.2019.10.02.12.15.09; Wed, 02 Oct 2019 12:15:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730028AbfJBTLy (ORCPT + 99 others); Wed, 2 Oct 2019 15:11:54 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35608 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729213AbfJBTIM (ORCPT ); Wed, 2 Oct 2019 15:08:12 -0400 Received: from [192.168.4.242] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1iFjyr-00036B-NH; Wed, 02 Oct 2019 20:08:09 +0100 Received: from ben by deadeye with local (Exim 4.92.1) (envelope-from ) id 1iFjyo-0003e7-No; Wed, 02 Oct 2019 20:08:06 +0100 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, Denis Kirjanov , "Jann Horn" , "Eric W. Biederman" , "Oleg Nesterov" , "Kees Cook" Date: Wed, 02 Oct 2019 20:06:51 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) X-Patchwork-Hint: ignore Subject: [PATCH 3.16 53/87] ptrace: restore smp_rmb() in __ptrace_may_access() In-Reply-To: X-SA-Exim-Connect-IP: 192.168.4.242 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.75-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Jann Horn commit f6581f5b55141a95657ef5742cf6a6bfa20a109f upstream. Restore the read memory barrier in __ptrace_may_access() that was deleted a couple years ago. Also add comments on this barrier and the one it pairs with to explain why they're there (as far as I understand). Fixes: bfedb589252c ("mm: Add a user_ns owner to mm_struct and fix ptrace permission checks") Acked-by: Kees Cook Acked-by: Oleg Nesterov Signed-off-by: Jann Horn Signed-off-by: Eric W. Biederman Signed-off-by: Ben Hutchings --- kernel/cred.c | 9 +++++++++ kernel/ptrace.c | 10 ++++++++++ 2 files changed, 19 insertions(+) --- a/kernel/cred.c +++ b/kernel/cred.c @@ -439,6 +439,15 @@ int commit_creds(struct cred *new) if (task->mm) set_dumpable(task->mm, suid_dumpable); task->pdeath_signal = 0; + /* + * If a task drops privileges and becomes nondumpable, + * the dumpability change must become visible before + * the credential change; otherwise, a __ptrace_may_access() + * racing with this change may be able to attach to a task it + * shouldn't be able to attach to (as if the task had dropped + * privileges without becoming nondumpable). + * Pairs with a read barrier in __ptrace_may_access(). + */ smp_wmb(); } --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -324,6 +324,16 @@ static int __ptrace_may_access(struct ta return -EPERM; ok: rcu_read_unlock(); + /* + * If a task drops privileges and becomes nondumpable (through a syscall + * like setresuid()) while we are trying to access it, we must ensure + * that the dumpability is read after the credentials; otherwise, + * we may be able to attach to a task that we shouldn't be able to + * attach to (as if the task had dropped privileges without becoming + * nondumpable). + * Pairs with a write barrier in commit_creds(). + */ + smp_rmb(); mm = task->mm; if (mm && ((get_dumpable(mm) != SUID_DUMP_USER) &&