linux-kernel - [tip:core/urgent] futex: Prevent attaching to kernel threads

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-f0d71b3dcb8332f7971b5f2363632573e6d9486a@git.kernel.org>
Date:	Mon, 19 May 2014 05:22:31 -0700
From:	tip-bot for Thomas Gleixner <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	mingo@...nel.org, williams@...hat.com,
	torvalds@...ux-foundation.org, peterz@...radead.org,
	jakub@...hat.com, rostedt@...dmis.org, bigeasy@...utronix.de,
	tglx@...utronix.de, laijs@...fujitsu.com, davidlohr@...com,
	linux-kernel@...r.kernel.org, hpa@...or.com, darren@...art.com,
	davej@...hat.com, paulmck@...ux.vnet.ibm.com, carlos@...hat.com,
	roland@...k.frob.com, mtk.manpages@...il.com
Subject: [tip:core/urgent] futex: Prevent attaching to kernel threads

Commit-ID:  f0d71b3dcb8332f7971b5f2363632573e6d9486a
Gitweb:     http://git.kernel.org/tip/f0d71b3dcb8332f7971b5f2363632573e6d9486a
Author:     Thomas Gleixner <tglx@...utronix.de>
AuthorDate: Mon, 12 May 2014 20:45:35 +0000
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Mon, 19 May 2014 21:18:49 +0900

futex: Prevent attaching to kernel threads

We happily allow userspace to declare a random kernel thread to be the
owner of a user space PI futex.

Found while analysing the fallout of Dave Jones syscall fuzzer.

We also should validate the thread group for private futexes and find
some fast way to validate whether the "alleged" owner has RW access on
the file which backs the SHM, but that's a separate issue.

Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Dave Jones <davej@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Darren Hart <darren@...art.com>
Cc: Davidlohr Bueso <davidlohr@...com>
Cc: Steven Rostedt <rostedt@...dmis.org>
Cc: Clark Williams <williams@...hat.com>
Cc: Paul McKenney <paulmck@...ux.vnet.ibm.com>
Cc: Lai Jiangshan <laijs@...fujitsu.com>
Cc: Roland McGrath <roland@...k.frob.com>
Cc: Carlos ODonell <carlos@...hat.com>
Cc: Jakub Jelinek <jakub@...hat.com>
Cc: Michael Kerrisk <mtk.manpages@...il.com>
Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Link: http://lkml.kernel.org/r/20140512201701.194824402@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: stable@...r.kernel.org
---
 kernel/futex.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/futex.c b/kernel/futex.c
index 7c68225..81dbe77 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -814,6 +814,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 	if (!p)
 		return -ESRCH;
 
+	if (!p->mm) {
+		put_task_struct(p);
+		return -EPERM;
+	}
+
 	/*
 	 * We need to look at the task state flags to figure out,
 	 * whether the task is exiting. To protect against the do_exit
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/