linux.git/fs/binfmt_misc.c, branch v4.14

fs/binfmt_misc.c: node could be NULL when evicting inode

2017-10-13T23:18:33+00:00

inode->i_private is assigned by a Node pointer only after registering a
new binary format, so it could be NULL if inode was created by
bm_fill_super() (or iput() was called by the error path in
bm_register_write()), and this could result in NULL pointer dereference
when evicting such an inode.  e.g.  mount binfmt_misc filesystem then
umount it immediately:

  mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc
  umount /proc/sys/fs/binfmt_misc

will result in

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000013
  IP: bm_evict_inode+0x16/0x40 [binfmt_misc]
  ...
  Call Trace:
   evict+0xd3/0x1a0
   iput+0x17d/0x1d0
   dentry_unlink_inode+0xb9/0xf0
   __dentry_kill+0xc7/0x170
   shrink_dentry_list+0x122/0x280
   shrink_dcache_parent+0x39/0x90
   do_one_tree+0x12/0x40
   shrink_dcache_for_umount+0x2d/0x90
   generic_shutdown_super+0x1f/0x120
   kill_litter_super+0x29/0x40
   deactivate_locked_super+0x43/0x70
   deactivate_super+0x45/0x60
   cleanup_mnt+0x3f/0x70
   __cleanup_mnt+0x12/0x20
   task_work_run+0x86/0xa0
   exit_to_usermode_loop+0x6d/0x99
   syscall_return_slowpath+0xba/0xf0
   entry_SYSCALL_64_fastpath+0xa3/0xa

Fix it by making sure Node (e) is not NULL.

Link: http://lkml.kernel.org/r/20171010100642.31786-1-eguan@redhat.com
Fixes: 83f918274e4b ("exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode()")
Signed-off-by: Eryu Guan 
Acked-by: Oleg Nesterov 
Cc: Alexander Viro 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: binfmt_misc: kill the onstack iname[BINPRM_BUF_SIZE] array

2017-10-04T00:54:25+00:00

After the previous change "fmt" can't go away, we can kill
iname/iname_addr and use fmt->interpreter.

Link: http://lkml.kernel.org/r/20170922143653.GA17232@redhat.com
Signed-off-by: Oleg Nesterov 
Acked-by: Kees Cook 
Cc: Al Viro 
Cc: Ben Woodard 
Cc: James Bottomley 
Cc: Jim Foraker 
Cc: 
Cc: Travis Gummels 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: binfmt_misc: fix race between load_misc_binary() and kill_node()

2017-10-04T00:54:25+00:00

load_misc_binary() makes a local copy of fmt->interpreter under
entries_lock to avoid the race with kill_node() but this is not enough;
the whole Node can be freed after we drop entries_lock, not only the
->interpreter string.

Add dget/dput(fmt->dentry) to ensure bm_evict_inode() can't destroy/free
this Node.

Link: http://lkml.kernel.org/r/20170922143650.GA17227@redhat.com
Signed-off-by: Oleg Nesterov 
Acked-by: Kees Cook 
Cc: Al Viro 
Cc: Ben Woodard 
Cc: James Bottomley 
Cc: Jim Foraker 
Cc: Travis Gummels 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: binfmt_misc: remove the confusing e->interp_file != NULL checks

2017-10-04T00:54:25+00:00

If MISC_FMT_OPEN_FILE flag is set e->interp_file must be valid or we
have a bug which should not be silently ignored.

Link: http://lkml.kernel.org/r/20170922143647.GA17222@redhat.com
Signed-off-by: Oleg Nesterov 
Acked-by: Kees Cook 
Cc: Al Viro 
Cc: Ben Woodard 
Cc: James Bottomley 
Cc: Jim Foraker 
Cc: 
Cc: Travis Gummels 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: binfmt_misc: shift filp_close(interp_file) from kill_node() to bm_evict_inode()

2017-10-04T00:54:25+00:00

To ensure that load_misc_binary() can't use the partially destroyed
Node, see also the next patch.

The current logic looks wrong in any case, once we close interp_file it
doesn't make any sense to delay kfree(inode->i_private), this Node is no
longer valid.  Even if the MISC_FMT_OPEN_FILE/interp_file checks were
not racy (they are), load_misc_binary() should not try to reopen
->interpreter if MISC_FMT_OPEN_FILE is set but ->interp_file is NULL.

And I can't understand why do we use filp_close(), not fput().

Link: http://lkml.kernel.org/r/20170922143644.GA17216@redhat.com
Signed-off-by: Oleg Nesterov 
Acked-by: Kees Cook 
Cc: Al Viro 
Cc: Ben Woodard 
Cc: James Bottomley 
Cc: Jim Foraker 
Cc: 
Cc: Travis Gummels 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

exec: binfmt_misc: don't nullify Node->dentry in kill_node()

2017-10-04T00:54:25+00:00

kill_node() nullifies/checks Node->dentry to avoid double free.  This
complicates the next changes and this is very confusing:

 - we do not need to check dentry != NULL under entries_lock,
   kill_node() is always called under inode_lock(d_inode(root)) and we
   rely on this inode_lock() anyway, without this lock the
   MISC_FMT_OPEN_FILE cleanup could race with itself.

 - if kill_inode() was already called and ->dentry == NULL we should not
   even try to close e->interp_file.

We can change bm_entry_write() to simply check !list_empty(list) before
kill_node.  Again, we rely on inode_lock(), in particular it saves us
from the race with bm_status_write(), another caller of kill_node().

Link: http://lkml.kernel.org/r/20170922143641.GA17210@redhat.com
Signed-off-by: Oleg Nesterov 
Acked-by: Kees Cook 
Cc: Al Viro 
Cc: Ben Woodard 
Cc: James Bottomley 
Cc: Jim Foraker 
Cc: 
Cc: Travis Gummels 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

fs: fix kernel_read prototype

2017-09-04T23:05:15+00:00

Use proper ssize_t and size_t types for the return value and count
argument, move the offset last and make it an in/out argument like
all other read/write helpers, and make the buf argument a void pointer
to get rid of lots of casts in the callers.

Signed-off-by: Christoph Hellwig 
Signed-off-by: Al Viro

fs: constify tree_descr arrays passed to simple_fill_super()

2017-04-27T03:54:06+00:00

simple_fill_super() is passed an array of tree_descr structures which
describe the files to create in the filesystem's root directory.  Since
these arrays are never modified intentionally, they should be 'const' so
that they are placed in .rodata and benefit from memory protection.
This patch updates the function signature and all users, and also
constifies tree_descr.name.

Signed-off-by: Eric Biggers 
Signed-off-by: Al Viro

sched/headers: Prepare to remove the dependency from

2017-03-02T07:42:37+00:00

Update code that relied on sched.h including various MM types for them.

This will allow us to remove the  include from .

Acked-by: Linus Torvalds 
Cc: Mike Galbraith 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar

fs: Replace current_fs_time() with current_time()

2016-09-28T01:06:22+00:00

current_fs_time() uses struct super_block* as an argument.
As per Linus's suggestion, this is changed to take struct
inode* as a parameter instead. This is because the function
is primarily meant for vfs inode timestamps.
Also the function was renamed as per Arnd's suggestion.

Change all calls to current_fs_time() to use the new
current_time() function instead. current_fs_time() will be
deleted.

Signed-off-by: Deepa Dinamani 
Signed-off-by: Al Viro