Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3525178pxf; Mon, 15 Mar 2021 11:29:42 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx4CYCQpEYy2PocOMBaxr/wkUhGGxJkYhf3+cSpzOqBhDmeX17IG+MrPVFqZiywDyyuyUXF X-Received: by 2002:a50:ec96:: with SMTP id e22mr31528863edr.385.1615832981771; Mon, 15 Mar 2021 11:29:41 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615832981; cv=none; d=google.com; s=arc-20160816; b=BR9gG++bNF1qqBdw4gvbqo11fSZuHfsm1QjlgjNQPUamyz8j1PbMHGYm1n9Av2eet0 +XYsHp6FHdWdsXezUcLqIxVKqu6pxo+m03CMA1d+ME7f/vkza0YnKKNUR2RMb+dKvJ44 jBaE9Czazpf3e7JyV4vaHRUy+y1DCtJ5NZBdKlHSwrToN7IEnQ5Oc422huVJnLEqOpOU eEM8RpSd5QPWAFY5MWlTxCECDvj5xYKEXeWHiup4R1EpBT7gOhMp+S1O0eLUvxaonw2b QUTAlIuOK+btpUqhsqBwtc9utfU3wJkTh0AFLhqYvQmbKeHghu4uNlhMjYAmoGgv6lzQ p2lA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=TLnuU1bGKto0hneDpnkaqw/ao5eIoUQcpL+r28fqlMs=; b=urxzXF8KOoM3oORKrdSWwdBKJ+4o2H8u5NnG43zDOdqMYf529ZcRtIZ3tBoF1oFnS0 AvnFTDaHD3uTXtgt2enTQG7GJyzsGSf3ruHuhO7R56WgGWBlaF5cuvY+4cMpIfB5XHSp wi4YLXLL5Hl4DJsdEV8PHt3f/QnFpDbxmM9RPzPL0X93eGkWxf6DzWV72FZNvyWzJO5w EHeV9GCRXL8iZCdZHfPVHVL4fvSUKdRNAAe3zXjoM3O/bb7Ak+l3gOS+ShdBEHNxzDiF nL1fAAVsLkEdIhgF2gSDDRlsCcgQsKwrN5HZjsq9fd/D/mXNdjgJk0UZNY1nZf7TjlpL CoLg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=BtHl7DYY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y101si11591014ede.101.2021.03.15.11.29.14; Mon, 15 Mar 2021 11:29:41 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=BtHl7DYY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233286AbhCOOd6 (ORCPT + 99 others); Mon, 15 Mar 2021 10:33:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:35186 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233368AbhCOOBh (ORCPT ); Mon, 15 Mar 2021 10:01:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9D4C264FA7; Mon, 15 Mar 2021 14:01:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816865; bh=yaN49XIIDgAtP4qqR6/x5ODNu04vC1NLjRJL9m/gwnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BtHl7DYYbnh71s1leLAxF8ia7g7Es9I3Bdc3zRNWGRkfSmuO2B9kj7dwAQvFkLxG2 UD8vyT4GZortSmB4rByIvOVfRGq2kIxfyTEh4gDvmb3uR7y8W/M6W/ac21n2TVBiBm Z2ayulp2N+oRP5jCR3j5ZSD6H5cM0vypfUVpTLPQ= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lior Ribak , Helge Deller , Al Viro , Andrew Morton , Linus Torvalds Subject: [PATCH 5.4 159/168] binfmt_misc: fix possible deadlock in bm_register_write Date: Mon, 15 Mar 2021 14:56:31 +0100 Message-Id: <20210315135555.582411495@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135550.333963635@linuxfoundation.org> References: <20210315135550.333963635@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Lior Ribak commit e7850f4d844e0acfac7e570af611d89deade3146 upstream. There is a deadlock in bm_register_write: First, in the begining of the function, a lock is taken on the binfmt_misc root inode with inode_lock(d_inode(root)). Then, if the user used the MISC_FMT_OPEN_FILE flag, the function will call open_exec on the user-provided interpreter. open_exec will call a path lookup, and if the path lookup process includes the root of binfmt_misc, it will try to take a shared lock on its inode again, but it is already locked, and the code will get stuck in a deadlock To reproduce the bug: $ echo ":iiiii:E::ii::/proc/sys/fs/binfmt_misc/bla:F" > /proc/sys/fs/binfmt_misc/register backtrace of where the lock occurs (#5): 0 schedule () at ./arch/x86/include/asm/current.h:15 1 0xffffffff81b51237 in rwsem_down_read_slowpath (sem=0xffff888003b202e0, count=, state=state@entry=2) at kernel/locking/rwsem.c:992 2 0xffffffff81b5150a in __down_read_common (state=2, sem=) at kernel/locking/rwsem.c:1213 3 __down_read (sem=) at kernel/locking/rwsem.c:1222 4 down_read (sem=) at kernel/locking/rwsem.c:1355 5 0xffffffff811ee22a in inode_lock_shared (inode=) at ./include/linux/fs.h:783 6 open_last_lookups (op=0xffffc9000022fe34, file=0xffff888004098600, nd=0xffffc9000022fd10) at fs/namei.c:3177 7 path_openat (nd=nd@entry=0xffffc9000022fd10, op=op@entry=0xffffc9000022fe34, flags=flags@entry=65) at fs/namei.c:3366 8 0xffffffff811efe1c in do_filp_open (dfd=, pathname=pathname@entry=0xffff8880031b9000, op=op@entry=0xffffc9000022fe34) at fs/namei.c:3396 9 0xffffffff811e493f in do_open_execat (fd=fd@entry=-100, name=name@entry=0xffff8880031b9000, flags=, flags@entry=0) at fs/exec.c:913 10 0xffffffff811e4a92 in open_exec (name=) at fs/exec.c:948 11 0xffffffff8124aa84 in bm_register_write (file=, buffer=, count=19, ppos=) at fs/binfmt_misc.c:682 12 0xffffffff811decd2 in vfs_write (file=file@entry=0xffff888004098500, buf=buf@entry=0xa758d0 ":iiiii:E::ii::i:CF ", count=count@entry=19, pos=pos@entry=0xffffc9000022ff10) at fs/read_write.c:603 13 0xffffffff811defda in ksys_write (fd=, buf=0xa758d0 ":iiiii:E::ii::i:CF ", count=19) at fs/read_write.c:658 14 0xffffffff81b49813 in do_syscall_64 (nr=, regs=0xffffc9000022ff58) at arch/x86/entry/common.c:46 15 0xffffffff81c0007c in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:120 To solve the issue, the open_exec call is moved to before the write lock is taken by bm_register_write Link: https://lkml.kernel.org/r/20210228224414.95962-1-liorribak@gmail.com Fixes: 948b701a607f1 ("binfmt_misc: add persistent opened binary handler for containers") Signed-off-by: Lior Ribak Acked-by: Helge Deller Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/binfmt_misc.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -696,12 +696,24 @@ static ssize_t bm_register_write(struct struct super_block *sb = file_inode(file)->i_sb; struct dentry *root = sb->s_root, *dentry; int err = 0; + struct file *f = NULL; e = create_entry(buffer, count); if (IS_ERR(e)) return PTR_ERR(e); + if (e->flags & MISC_FMT_OPEN_FILE) { + f = open_exec(e->interpreter); + if (IS_ERR(f)) { + pr_notice("register: failed to install interpreter file %s\n", + e->interpreter); + kfree(e); + return PTR_ERR(f); + } + e->interp_file = f; + } + inode_lock(d_inode(root)); dentry = lookup_one_len(e->name, root, strlen(e->name)); err = PTR_ERR(dentry); @@ -725,21 +737,6 @@ static ssize_t bm_register_write(struct goto out2; } - if (e->flags & MISC_FMT_OPEN_FILE) { - struct file *f; - - f = open_exec(e->interpreter); - if (IS_ERR(f)) { - err = PTR_ERR(f); - pr_notice("register: failed to install interpreter file %s\n", e->interpreter); - simple_release_fs(&bm_mnt, &entry_count); - iput(inode); - inode = NULL; - goto out2; - } - e->interp_file = f; - } - e->dentry = dget(dentry); inode->i_private = e; inode->i_fop = &bm_entry_operations; @@ -756,6 +753,8 @@ out: inode_unlock(d_inode(root)); if (err) { + if (f) + filp_close(f, NULL); kfree(e); return err; }