linux-kernel - Re: [PATCH 5.4 033/222] io_uring: only allow submit from owning task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c7fd4357-79b8-60a9-14cf-31ec07a1153d@samba.org>
Date:   Fri, 24 Jan 2020 11:41:16 +0100
From:   Stefan Metzmacher <metze@...ba.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
Cc:     stable@...r.kernel.org, Jens Axboe <axboe@...nel.dk>,
        io-uring <io-uring@...r.kernel.org>
Subject: Re: [PATCH 5.4 033/222] io_uring: only allow submit from owning task

Am 24.01.20 um 11:38 schrieb Stefan Metzmacher:
> Am 22.01.20 um 10:26 schrieb Greg Kroah-Hartman:
>> From: Jens Axboe <axboe@...nel.dk>
>>
>> commit 44d282796f81eb1debc1d7cb53245b4cb3214cb5 upstream.
>>
>> If the credentials or the mm doesn't match, don't allow the task to
>> submit anything on behalf of this ring. The task that owns the ring can
>> pass the file descriptor to another task, but we don't want to allow
>> that task to submit an SQE that then assumes the ring mm and creds if
>> it needs to go async.
>>
>> Cc: stable@...r.kernel.org
>> Suggested-by: Stefan Metzmacher <metze@...ba.org>
>> Signed-off-by: Jens Axboe <axboe@...nel.dk>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>>
>>
>> ---
>>  fs/io_uring.c |    6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> --- a/fs/io_uring.c
>> +++ b/fs/io_uring.c
>> @@ -3716,6 +3716,12 @@ SYSCALL_DEFINE6(io_uring_enter, unsigned
>>  			wake_up(&ctx->sqo_wait);
>>  		submitted = to_submit;
>>  	} else if (to_submit) {
>> +		if (current->mm != ctx->sqo_mm ||
>> +		    current_cred() != ctx->creds) {
>> +			ret = -EPERM;
>> +			goto out;
>> +		}
>> +
> 
> I thought about this a bit more.
> 
> I'm not sure if this is actually to restrictive,
> because it means applications like Samba won't
> be able to use io-uring at all.

Even for simple operations like IORING_OP_READ*, IORING_OP_WRITE*,
IORING_OP_FSYNC and IORING_OP_SYNC_FILE_RANGE, which only operate
on the given fd.

metze



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)