linux-kernel - [PATCH] fs/fcntl: return -ESRCH in f_setown when pid/pgid can't be found

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 14 Jun 2017 10:52:55 -0400
From:   Jeff Layton <jlayton@...hat.com>
To:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     jslaby@...e.cz, zhongjiang@...wei.com, bfields@...ldses.org,
        viro@...iv.linux.org.uk, dhowells@...hat.com
Subject: [PATCH] fs/fcntl: return -ESRCH in f_setown when pid/pgid can't be found

The current implementation of F_SETOWN doesn't properly vet the argument
passed in. It never returns an error. If the argument doesn't specify a
valid pid/pgid, then we just end up cleaning out the file->f_owner
structure.

What we really want is to only clean that out only in the case where
userland passed in an argument of 0. For anything else, we want to
return ESRCH if it doesn't refer to a valid pid.

The relevant POSIX spec page is here:

    http://pubs.opengroup.org/onlinepubs/9699919799/functions/fcntl.html

Cc: Jiri Slaby <jslaby@...e.cz>
Cc: zhong jiang <zhongjiang@...wei.com>
Signed-off-by: Jeff Layton <jlayton@...hat.com>
---
 fs/fcntl.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 693322e28751..afed3b364979 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -112,8 +112,9 @@ EXPORT_SYMBOL(__f_setown);
 int f_setown(struct file *filp, unsigned long arg, int force)
 {
 	enum pid_type type;
-	struct pid *pid;
-	int who = arg;
+	struct pid *pid = NULL;
+	int who = arg, ret = 0;
+
 	type = PIDTYPE_PID;
 	if (who < 0) {
 		/* avoid overflow below */
@@ -123,12 +124,19 @@ int f_setown(struct file *filp, unsigned long arg, int force)
 		type = PIDTYPE_PGID;
 		who = -who;
 	}
+
 	rcu_read_lock();
-	pid = find_vpid(who);
-	__f_setown(filp, pid, type, force);
+	if (who) {
+		pid = find_vpid(who);
+		if (!pid)
+			ret = -ESRCH;
+	}
+
+	if (!ret)
+		__f_setown(filp, pid, type, force);
 	rcu_read_unlock();
 
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL(f_setown);
 
-- 
2.13.0