| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 11 Apr 2022 10:05:48 -0600
From: Khalid Aziz <khalid.aziz@...cle.com>
To: akpm@...ux-foundation.org, willy@...radead.org
Cc: Khalid Aziz <khalid.aziz@...cle.com>, aneesh.kumar@...ux.ibm.com,
arnd@...db.de, 21cnbao@...il.com, corbet@....net,
dave.hansen@...ux.intel.com, david@...hat.com,
ebiederm@...ssion.com, hagen@...u.net, jack@...e.cz,
keescook@...omium.org, kirill@...temov.name, kucharsk@...il.com,
linkinjeon@...nel.org, linux-fsdevel@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-mm@...ck.org,
longpeng2@...wei.com, luto@...nel.org, markhemm@...glemail.com,
pcc@...gle.com, rppt@...nel.org, sieberf@...zon.com,
sjpark@...zon.de, surenb@...gle.com, tst@...oebel-theuer.de,
yzaikin@...gle.com
Subject: [PATCH v1 04/14] mm/mshare: implement mshare_unlink syscall
Add code to allow mshare syscall to be made for an exisitng mshare'd
region. Complete the implementation for mshare_unlink syscall. Make
reading mshare resource name from userspace safer. Fix code to allow
msharefs to be unmounted cleanly.
Signed-off-by: Khalid Aziz <khalid.aziz@...cle.com>
---
mm/mshare.c | 144 +++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 113 insertions(+), 31 deletions(-)
diff --git a/mm/mshare.c b/mm/mshare.c
index 0247275aac50..b9d7836f9bd1 100644
--- a/mm/mshare.c
+++ b/mm/mshare.c
@@ -23,11 +23,24 @@
struct mshare_data {
struct mm_struct *mm;
+ mode_t mode;
refcount_t refcnt;
};
static struct super_block *msharefs_sb;
+static void
+msharefs_evict_inode(struct inode *inode)
+{
+ clear_inode(inode);
+}
+
+static const struct super_operations msharefs_ops = {
+ .statfs = simple_statfs,
+ .drop_inode = generic_delete_inode,
+ .evict_inode = msharefs_evict_inode,
+};
+
static ssize_t
mshare_read(struct kiocb *iocb, struct iov_iter *iov)
{
@@ -115,7 +128,7 @@ static struct inode
}
static int
-mshare_file_create(const char *name, unsigned long flags,
+mshare_file_create(struct filename *fname, int flags,
struct mshare_data *info)
{
struct inode *inode;
@@ -124,13 +137,16 @@ mshare_file_create(const char *name, unsigned long flags,
root = msharefs_sb->s_root;
+ /*
+ * This is a read only file.
+ */
inode = msharefs_get_inode(msharefs_sb, S_IFREG | 0400);
if (IS_ERR(inode))
return PTR_ERR(inode);
inode->i_private = info;
- dentry = msharefs_alloc_dentry(root, name);
+ dentry = msharefs_alloc_dentry(root, fname->name);
if (IS_ERR(dentry)) {
err = PTR_ERR(dentry);
goto fail_inode;
@@ -138,6 +154,7 @@ mshare_file_create(const char *name, unsigned long flags,
d_add(dentry, inode);
+ dput(dentry);
return err;
fail_inode:
@@ -151,10 +168,13 @@ mshare_file_create(const char *name, unsigned long flags,
SYSCALL_DEFINE5(mshare, const char __user *, name, unsigned long, addr,
unsigned long, len, int, oflag, mode_t, mode)
{
- char mshare_name[NAME_MAX];
struct mshare_data *info;
struct mm_struct *mm;
- int err;
+ struct filename *fname = getname(name);
+ struct dentry *dentry;
+ struct inode *inode;
+ struct qstr namestr;
+ int err = PTR_ERR(fname);
/*
* Address range being shared must be aligned to pgdir
@@ -163,29 +183,56 @@ SYSCALL_DEFINE5(mshare, const char __user *, name, unsigned long, addr,
if ((addr | len) & (PGDIR_SIZE - 1))
return -EINVAL;
- err = copy_from_user(mshare_name, name, NAME_MAX);
+ if (IS_ERR(fname))
+ goto err_out;
+
+ /*
+ * Does this mshare entry exist already? If it does, calling
+ * mshare with O_EXCL|O_CREAT is an error
+ */
+ namestr.name = fname->name;
+ namestr.len = strlen(fname->name);
+ err = msharefs_d_hash(msharefs_sb->s_root, &namestr);
if (err)
goto err_out;
+ dentry = d_lookup(msharefs_sb->s_root, &namestr);
+ if (dentry && (oflag & (O_EXCL|O_CREAT))) {
+ err = -EEXIST;
+ dput(dentry);
+ goto err_out;
+ }
- mm = mm_alloc();
- if (!mm)
- return -ENOMEM;
- info = kzalloc(sizeof(*info), GFP_KERNEL);
- if (!info) {
- err = -ENOMEM;
- goto err_relmm;
+ if (dentry) {
+ inode = d_inode(dentry);
+ if (inode == NULL) {
+ err = -EINVAL;
+ goto err_out;
+ }
+ info = inode->i_private;
+ refcount_inc(&info->refcnt);
+ dput(dentry);
+ } else {
+ mm = mm_alloc();
+ if (!mm)
+ return -ENOMEM;
+ info = kzalloc(sizeof(*info), GFP_KERNEL);
+ if (!info) {
+ err = -ENOMEM;
+ goto err_relmm;
+ }
+ mm->mmap_base = addr;
+ mm->task_size = addr + len;
+ if (!mm->task_size)
+ mm->task_size--;
+ info->mm = mm;
+ info->mode = mode;
+ refcount_set(&info->refcnt, 1);
+ err = mshare_file_create(fname, oflag, info);
+ if (err)
+ goto err_relinfo;
}
- mm->mmap_base = addr;
- mm->task_size = addr + len;
- if (!mm->task_size)
- mm->task_size--;
- info->mm = mm;
- refcount_set(&info->refcnt, 1);
-
- err = mshare_file_create(mshare_name, oflag, info);
- if (err)
- goto err_relinfo;
+ putname(fname);
return 0;
err_relinfo:
@@ -193,6 +240,7 @@ SYSCALL_DEFINE5(mshare, const char __user *, name, unsigned long, addr,
err_relmm:
mmput(mm);
err_out:
+ putname(fname);
return err;
}
@@ -201,21 +249,54 @@ SYSCALL_DEFINE5(mshare, const char __user *, name, unsigned long, addr,
*/
SYSCALL_DEFINE1(mshare_unlink, const char *, name)
{
- char mshare_name[NAME_MAX];
- int err;
+ struct filename *fname = getname(name);
+ int err = PTR_ERR(fname);
+ struct dentry *dentry;
+ struct inode *inode;
+ struct mshare_data *info;
+ struct qstr namestr;
- /*
- * Delete the named object
- *
- * TODO: Mark mshare'd range for deletion
- *
- */
- err = copy_from_user(mshare_name, name, NAME_MAX);
+ if (IS_ERR(fname))
+ goto err_out;
+
+ namestr.name = fname->name;
+ namestr.len = strlen(fname->name);
+ err = msharefs_d_hash(msharefs_sb->s_root, &namestr);
if (err)
goto err_out;
+ dentry = d_lookup(msharefs_sb->s_root, &namestr);
+ if (dentry == NULL) {
+ err = -EINVAL;
+ goto err_out;
+ }
+
+ inode = d_inode(dentry);
+ if (inode == NULL) {
+ err = -EINVAL;
+ goto err_dput;
+ }
+ info = inode->i_private;
+
+ /*
+ * Is this the last reference?
+ */
+ if (refcount_dec_and_test(&info->refcnt)) {
+ simple_unlink(d_inode(msharefs_sb->s_root), dentry);
+ d_drop(dentry);
+ d_delete(dentry);
+ mmput(info->mm);
+ kfree(info);
+ } else {
+ dput(dentry);
+ }
+
+ putname(fname);
return 0;
+err_dput:
+ dput(dentry);
err_out:
+ putname(fname);
return err;
}
@@ -229,6 +310,7 @@ msharefs_fill_super(struct super_block *sb, struct fs_context *fc)
static const struct tree_descr empty_descr = {""};
int err;
+ sb->s_op = &msharefs_ops;
sb->s_d_op = &msharefs_d_ops;
err = simple_fill_super(sb, MSHARE_MAGIC, &empty_descr);
if (err)
--
2.32.0
Powered by blists - more mailing lists