Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20200127210014.5207-1-tkjos@google.com> <CAJWu+orT-A5HVi97ccKwMvs9MvXWV0MZhsKcZDNS8r-gqRmcDA@mail.gmail.com>
 <CAHRSSEw67bY9V7un_t1oV2dsfE72BCAtOj_OH4wyQLpuEAjUfg@mail.gmail.com>
In-Reply-To: <CAHRSSEw67bY9V7un_t1oV2dsfE72BCAtOj_OH4wyQLpuEAjUfg@mail.gmail.com>
From:   Suren Baghdasaryan <surenb@google.com>
Date:   Mon, 27 Jan 2020 16:05:50 -0800
Message-ID: <CAJuCfpEYUsBt2iNixkOd9L0Wd4+0tNDquC3_fgRKtN63ZU=sjg@mail.gmail.com>
Subject: Re: [PATCH] staging: android: ashmem: Disallow ashmem memory from
 being remapped
To:     Todd Kjos <tkjos@google.com>
Cc:     Joel Fernandes <joelaf@google.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Arve Hjonnevag <arve@android.com>,
        "open list:ANDROID DRIVERS" <devel@driverdev.osuosl.org>,
        LKML <linux-kernel@vger.kernel.org>,
        Martijn Coenen <maco@google.com>,
        "Joel Fernandes (Google)" <joel@joelfernandes.org>,
        "Cc: Android Kernel" <kernel-team@android.com>,
        Jann Horn <jannh@google.com>, stable <stable@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Jan 27, 2020 at 3:57 PM 'Todd Kjos' via kernel-team
<kernel-team@android.com> wrote:
>
> On Mon, Jan 27, 2020 at 2:30 PM Joel Fernandes <joelaf@google.com> wrote:
> >
> > On Mon, Jan 27, 2020 at 1:00 PM 'Todd Kjos' via kernel-team
> > <kernel-team@android.com> wrote:
> > >
> > > From: Suren Baghdasaryan <surenb@google.com>
> > >
> > > When ashmem file is being mmapped the resulting vma->vm_file points to the
> > > backing shmem file with the generic fops that do not check ashmem
> > > permissions like fops of ashmem do. Fix that by disallowing mapping
> > > operation for backing shmem file.
> >
> > Looks good, but I think the commit message is confusing. I had to read
> > the code a couple times to understand what's going on since there are
> > no links to a PoC for the security issue, in the commit message. I
> > think a better message could have been:
> >
> >  When ashmem file is mmapped, the resulting vma->vm_file points to the
> >  backing shmem file with the generic fops that do not check ashmem
> >  permissions like fops of ashmem do. If an mremap is done on the ashmem
> >  region, then the permission checks will be skipped. Fix that by disallowing
> >  mapping operation on the backing shmem file.
>
> Sent v2 with the suggested change.

Sorry for the delay. The suggestion makes sense to me. Thanks!

>
> >
> > Or did I miss something?
> >
> > thanks!
> >
> > - Joel
> >
> >
> >
> > >
> > > Reported-by: Jann Horn <jannh@google.com>
> > > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
> > > Cc: stable <stable@vger.kernel.org> # 4.4,4.9,4.14,4.18,5.4
> > > Signed-off-by: Todd Kjos <tkjos@google.com>
> > > ---
> > >  drivers/staging/android/ashmem.c | 28 ++++++++++++++++++++++++++++
> > >  1 file changed, 28 insertions(+)
> > >
> > > diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
> > > index 74d497d39c5a..c6695354b123 100644
> > > --- a/drivers/staging/android/ashmem.c
> > > +++ b/drivers/staging/android/ashmem.c
> > > @@ -351,8 +351,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot)
> > >                _calc_vm_trans(prot, PROT_EXEC,  VM_MAYEXEC);
> > >  }
> > >
> > > +static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma)
> > > +{
> > > +       /* do not allow to mmap ashmem backing shmem file directly */
> > > +       return -EPERM;
> > > +}
> > > +
> > > +static unsigned long
> > > +ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr,
> > > +                               unsigned long len, unsigned long pgoff,
> > > +                               unsigned long flags)
> > > +{
> > > +       return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
> > > +}
> > > +
> > >  static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
> > >  {
> > > +       static struct file_operations vmfile_fops;
> > >         struct ashmem_area *asma = file->private_data;
> > >         int ret = 0;
> > >
> > > @@ -393,6 +408,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
> > >                 }
> > >                 vmfile->f_mode |= FMODE_LSEEK;
> > >                 asma->file = vmfile;
> > > +               /*
> > > +                * override mmap operation of the vmfile so that it can't be
> > > +                * remapped which would lead to creation of a new vma with no
> > > +                * asma permission checks. Have to override get_unmapped_area
> > > +                * as well to prevent VM_BUG_ON check for f_ops modification.
> > > +                */
> > > +               if (!vmfile_fops.mmap) {
> > > +                       vmfile_fops = *vmfile->f_op;
> > > +                       vmfile_fops.mmap = ashmem_vmfile_mmap;
> > > +                       vmfile_fops.get_unmapped_area =
> > > +                                       ashmem_vmfile_get_unmapped_area;
> > > +               }
> > > +               vmfile->f_op = &vmfile_fops;
> > >         }
> > >         get_file(asma->file);
> > >
> > > --
> > > 2.25.0.341.g760bfbb309-goog
> > >
> > > --
> > > To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe@android.com.
> > >
>
> --
> To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe@android.com.
>