Smack: fix use-after-free in smk_write_relabel_self()
commit5.4-rM2-2.2.x-imx-squashedbeb4ee6770
upstream. smk_write_relabel_self() frees memory from the task's credentials with no locking, which can easily cause a use-after-free because multiple tasks can share the same credentials structure. Fix this by using prepare_creds() and commit_creds() to correctly modify the task's credentials. Reproducer for "BUG: KASAN: use-after-free in smk_write_relabel_self": #include <fcntl.h> #include <pthread.h> #include <unistd.h> static void *thrproc(void *arg) { int fd = open("/sys/fs/smackfs/relabel-self", O_WRONLY); for (;;) write(fd, "foo", 3); } int main() { pthread_t t; pthread_create(&t, NULL, thrproc, NULL); thrproc(NULL); } Reported-by: syzbot+e6416dabb497a650da40@syzkaller.appspotmail.com Fixes:38416e5393
("Smack: limited capability for changing process label") Cc: <stable@vger.kernel.org> # v4.4+ Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
c5665cafbe
commit
5f5fb7cea8
|
@ -2720,7 +2720,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file)
|
||||||
static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
|
static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
|
||||||
size_t count, loff_t *ppos)
|
size_t count, loff_t *ppos)
|
||||||
{
|
{
|
||||||
struct task_smack *tsp = smack_cred(current_cred());
|
|
||||||
char *data;
|
char *data;
|
||||||
int rc;
|
int rc;
|
||||||
LIST_HEAD(list_tmp);
|
LIST_HEAD(list_tmp);
|
||||||
|
@ -2745,11 +2744,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
|
||||||
kfree(data);
|
kfree(data);
|
||||||
|
|
||||||
if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) {
|
if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) {
|
||||||
|
struct cred *new;
|
||||||
|
struct task_smack *tsp;
|
||||||
|
|
||||||
|
new = prepare_creds();
|
||||||
|
if (!new) {
|
||||||
|
rc = -ENOMEM;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
tsp = smack_cred(new);
|
||||||
smk_destroy_label_list(&tsp->smk_relabel);
|
smk_destroy_label_list(&tsp->smk_relabel);
|
||||||
list_splice(&list_tmp, &tsp->smk_relabel);
|
list_splice(&list_tmp, &tsp->smk_relabel);
|
||||||
|
commit_creds(new);
|
||||||
return count;
|
return count;
|
||||||
}
|
}
|
||||||
|
out:
|
||||||
smk_destroy_label_list(&list_tmp);
|
smk_destroy_label_list(&list_tmp);
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue