Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3528626pxf; Mon, 15 Mar 2021 11:34:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyJ2VbFcV51W4gq2+iigmUgVCka0sjy/+HhkB2zEWRmzfdQueoOtThsLelUgGuAloamQe3b X-Received: by 2002:a17:906:1706:: with SMTP id c6mr4019250eje.223.1615833257207; Mon, 15 Mar 2021 11:34:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615833257; cv=none; d=google.com; s=arc-20160816; b=t2kAoIHqX2BIcZ2YOWLgwy5LPOQpVtlaNB4QDE0wyA64sEAuBjzuF7Y1FrTdxY1hsi TEd5qLrWbJhQWWTO28HXhkKkazAfaybGUwJgOy6ucqefMpjvpGnXvJ1dxfJ6NW7krBmZ Q5b+sKupYr/nHYyrp0rUi3yKja14XxSv40gXMnxbC4hSdZj/vtYOYKxpAuE5QAPHVD49 vhoRXsqNkTHRmFQ/J0UwKiENfWIvaqhmi5ZaPBz8W40DzwMG2F7rgy5FJoZJblKq2WxI 8CSmBzDm5XYFI4A0ow3N1d8Qx9ZvErbmQA9PrWX5M1fbn5f/bbHOwRxjKNGUMTCJ0PPC AVLw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=m0pASt9ZtuLkNwA+LdJuksmHxbjoswdr9cCfOXjm7do=; b=CXoVn8VPWJ1SsACKL5JwYikiYnOsUZdlYrUnk0+1uCGnSM3OEoJFP4Qfx79YdeCot1 PKv9mZxMGuyKNsjNq9NlaODgg20xrpbfFv6Ukr/lE76oAi8IxhqC4ksbYMrKWh1oP3IV 3QVgF2gAq9ll/6dNFNzarvzCsgqZf6rZWAyvqWZbNuQ8Lhj4pM/VWOQ3RlMi4GU0Qgou uidK6W8eT13tbPRHugfdOkMdczpJHtSQ8p4FFIw+fKZSCjcBYzPoDvDwGEJJRGp4odKS WcMUcvwMAeOwQaHlqp00XCH9nbSoqdKVmVE09ffWL62lSx6y2jKCadM3ve338WsryzMb ycwg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="PNHUDj/U"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gy3si11696900ejb.557.2021.03.15.11.33.54; Mon, 15 Mar 2021 11:34:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b="PNHUDj/U"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238950AbhCOOqN (ORCPT + 99 others); Mon, 15 Mar 2021 10:46:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:52256 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234575AbhCOOEX (ORCPT ); Mon, 15 Mar 2021 10:04:23 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 19244601FD; Mon, 15 Mar 2021 14:04:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615817060; bh=x3Htg2voxND8Ah2g0xemyHciB6hV7tmKLcRWo8Y2DHg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PNHUDj/U2FiVOeufpd2Y3kRnfqVvBQx8LnrDQSb/9o1j/bqzQKOw77tiv/qB1fWDE o1BI47ICPKFn4LtoUtQE4PveNx5Nz9d5dWv4qsTdR5rLtrqGhxLrnco2UoJ68FrDJR 3ddXEESm4w2mnuJA1Dthxap34xo8Xt4GcQtR2mxc= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lior Ribak , Helge Deller , Al Viro , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 268/290] binfmt_misc: fix possible deadlock in bm_register_write Date: Mon, 15 Mar 2021 14:56:01 +0100 Message-Id: <20210315135551.076305421@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135541.921894249@linuxfoundation.org> References: <20210315135541.921894249@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Lior Ribak commit e7850f4d844e0acfac7e570af611d89deade3146 upstream. There is a deadlock in bm_register_write: First, in the begining of the function, a lock is taken on the binfmt_misc root inode with inode_lock(d_inode(root)). Then, if the user used the MISC_FMT_OPEN_FILE flag, the function will call open_exec on the user-provided interpreter. open_exec will call a path lookup, and if the path lookup process includes the root of binfmt_misc, it will try to take a shared lock on its inode again, but it is already locked, and the code will get stuck in a deadlock To reproduce the bug: $ echo ":iiiii:E::ii::/proc/sys/fs/binfmt_misc/bla:F" > /proc/sys/fs/binfmt_misc/register backtrace of where the lock occurs (#5): 0 schedule () at ./arch/x86/include/asm/current.h:15 1 0xffffffff81b51237 in rwsem_down_read_slowpath (sem=0xffff888003b202e0, count=, state=state@entry=2) at kernel/locking/rwsem.c:992 2 0xffffffff81b5150a in __down_read_common (state=2, sem=) at kernel/locking/rwsem.c:1213 3 __down_read (sem=) at kernel/locking/rwsem.c:1222 4 down_read (sem=) at kernel/locking/rwsem.c:1355 5 0xffffffff811ee22a in inode_lock_shared (inode=) at ./include/linux/fs.h:783 6 open_last_lookups (op=0xffffc9000022fe34, file=0xffff888004098600, nd=0xffffc9000022fd10) at fs/namei.c:3177 7 path_openat (nd=nd@entry=0xffffc9000022fd10, op=op@entry=0xffffc9000022fe34, flags=flags@entry=65) at fs/namei.c:3366 8 0xffffffff811efe1c in do_filp_open (dfd=, pathname=pathname@entry=0xffff8880031b9000, op=op@entry=0xffffc9000022fe34) at fs/namei.c:3396 9 0xffffffff811e493f in do_open_execat (fd=fd@entry=-100, name=name@entry=0xffff8880031b9000, flags=, flags@entry=0) at fs/exec.c:913 10 0xffffffff811e4a92 in open_exec (name=) at fs/exec.c:948 11 0xffffffff8124aa84 in bm_register_write (file=, buffer=, count=19, ppos=) at fs/binfmt_misc.c:682 12 0xffffffff811decd2 in vfs_write (file=file@entry=0xffff888004098500, buf=buf@entry=0xa758d0 ":iiiii:E::ii::i:CF ", count=count@entry=19, pos=pos@entry=0xffffc9000022ff10) at fs/read_write.c:603 13 0xffffffff811defda in ksys_write (fd=, buf=0xa758d0 ":iiiii:E::ii::i:CF ", count=19) at fs/read_write.c:658 14 0xffffffff81b49813 in do_syscall_64 (nr=, regs=0xffffc9000022ff58) at arch/x86/entry/common.c:46 15 0xffffffff81c0007c in entry_SYSCALL_64 () at arch/x86/entry/entry_64.S:120 To solve the issue, the open_exec call is moved to before the write lock is taken by bm_register_write Link: https://lkml.kernel.org/r/20210228224414.95962-1-liorribak@gmail.com Fixes: 948b701a607f1 ("binfmt_misc: add persistent opened binary handler for containers") Signed-off-by: Lior Ribak Acked-by: Helge Deller Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- fs/binfmt_misc.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-) --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -647,12 +647,24 @@ static ssize_t bm_register_write(struct struct super_block *sb = file_inode(file)->i_sb; struct dentry *root = sb->s_root, *dentry; int err = 0; + struct file *f = NULL; e = create_entry(buffer, count); if (IS_ERR(e)) return PTR_ERR(e); + if (e->flags & MISC_FMT_OPEN_FILE) { + f = open_exec(e->interpreter); + if (IS_ERR(f)) { + pr_notice("register: failed to install interpreter file %s\n", + e->interpreter); + kfree(e); + return PTR_ERR(f); + } + e->interp_file = f; + } + inode_lock(d_inode(root)); dentry = lookup_one_len(e->name, root, strlen(e->name)); err = PTR_ERR(dentry); @@ -676,21 +688,6 @@ static ssize_t bm_register_write(struct goto out2; } - if (e->flags & MISC_FMT_OPEN_FILE) { - struct file *f; - - f = open_exec(e->interpreter); - if (IS_ERR(f)) { - err = PTR_ERR(f); - pr_notice("register: failed to install interpreter file %s\n", e->interpreter); - simple_release_fs(&bm_mnt, &entry_count); - iput(inode); - inode = NULL; - goto out2; - } - e->interp_file = f; - } - e->dentry = dget(dentry); inode->i_private = e; inode->i_fop = &bm_entry_operations; @@ -707,6 +704,8 @@ out: inode_unlock(d_inode(root)); if (err) { + if (f) + filp_close(f, NULL); kfree(e); return err; }