linux-kernel - Re: [PATCH] eventpoll: fix uninitialized variable in epoll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20140820192920.GA25619@dcvr.yhbt.net>
Date:	Wed, 20 Aug 2014 19:29:20 +0000
From:	Eric Wong <normalperson@...t.net>
To:	Nicolas Iooss <nicolas.iooss_linux@....org>
Cc:	Alexander Viro <viro@...iv.linux.org.uk>,
	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Arve Hjønnevåg <arve@...roid.com>,
	NeilBrown <neilb@...e.de>, Jason Baron <jbaron@...mai.com>,
	"Rafael J. Wysocki" <rafael.j.wysocki@...el.com>,
	Amit Pundir <amit.pundir@...aro.org>, stable@...r.kernel.org
Subject: Re: [PATCH] eventpoll: fix uninitialized variable in epoll_ctl

Nicolas Iooss <nicolas.iooss_linux@....org> wrote:
> When calling epoll_ctl with operation EPOLL_CTL_DEL, structure epds is
> not initialized but ep_take_care_of_epollwakeup reads its event field.
> When this unintialized field has EPOLLWAKEUP bit set, a capability check
> is done for CAP_BLOCK_SUSPEND in ep_take_care_of_epollwakeup.  This
> produces unexpected messages in the audit log, such as (on a system
> running SELinux):
> 
>     type=AVC msg=audit(1408212798.866:410): avc:  denied
>     { block_suspend } for  pid=7754 comm="dbus-daemon" capability=36
>     scontext=unconfined_u:unconfined_r:unconfined_t
>     tcontext=unconfined_u:unconfined_r:unconfined_t
>     tclass=capability2 permissive=1
> 
>     type=SYSCALL msg=audit(1408212798.866:410): arch=c000003e syscall=233
>     success=yes exit=0 a0=3 a1=2 a2=9 a3=7fffd4d66ec0 items=0 ppid=1
>     pid=7754 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
>     fsgid=0 tty=(none) ses=3 comm="dbus-daemon"
>     exe="/usr/bin/dbus-daemon"
>     subj=unconfined_u:unconfined_r:unconfined_t key=(null)
> 
> ("arch=c000003e syscall=233 a1=2" means "epoll_ctl(op=EPOLL_CTL_DEL)")
> 
> Remove use of epds in epoll_ctl when op == EPOLL_CTL_DEL.
> 
> Fixes: 4d7e30d98939 ("epoll: Add a flag, EPOLLWAKEUP, to prevent suspend
> while epoll events are ready")
> Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@....org>

Looks good to me.  Tested without regressions on several of my
(non-EPOLLWAKEUP) projects.  Adding a few more folks to the Cc: list.

Acked-by: Eric Wong <normalperson@...t.net>

> ---
>  fs/eventpoll.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/eventpoll.c b/fs/eventpoll.c
> index b10b48c..7bcfff9 100644
> --- a/fs/eventpoll.c
> +++ b/fs/eventpoll.c
> @@ -1852,7 +1852,8 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
>  		goto error_tgt_fput;
>  
>  	/* Check if EPOLLWAKEUP is allowed */
> -	ep_take_care_of_epollwakeup(&epds);
> +	if (ep_op_has_event(op))
> +		ep_take_care_of_epollwakeup(&epds);
>  
>  	/*
>  	 * We have to check that the file structure underneath the file descriptor
> -- 
> 1.7.10.4
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/