Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1409649

[PATCH 4.4 03/86] perf/core: Fix perf_event_open() vs. execve() race

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.4 03/86] perf/core: Fix perf_event_open() vs. execve() race
Date 2016-05-31 00:10 +0200
Message-ID <rEDxM-1RI-17@gated-at.bofh.it> (permalink)
References <rECs1-VP-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 79c9ce57eb2d5f1497546a3946b4ae21b6fdc438 upstream.

Jann reported that the ptrace_may_access() check in
find_lively_task_by_vpid() is racy against exec().

Specifically:

  perf_event_open()		execve()

  ptrace_may_access()
				commit_creds()
  ...				if (get_dumpable() != SUID_DUMP_USER)
				  perf_event_exit_task();
  perf_install_in_context()

would result in installing a counter across the creds boundary.

Fix this by wrapping lots of perf_event_open() in cred_guard_mutex.
This should be fine as perf_event_exit_task() is already called with
cred_guard_mutex held, so all perf locks already nest inside it.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: He Kuang <hekuang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/events/core.c |   52 +++++++++++++++++++++++++++++++++++----------------
 1 file changed, 36 insertions(+), 16 deletions(-)

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -946,6 +946,7 @@ static void put_ctx(struct perf_event_co
  * function.
  *
  * Lock order:
+ *    cred_guard_mutex
  *	task_struct::perf_event_mutex
  *	  perf_event_context::mutex
  *	    perf_event_context::lock
@@ -3418,7 +3419,6 @@ static struct task_struct *
 find_lively_task_by_vpid(pid_t vpid)
 {
 	struct task_struct *task;
-	int err;
 
 	rcu_read_lock();
 	if (!vpid)
@@ -3432,16 +3432,7 @@ find_lively_task_by_vpid(pid_t vpid)
 	if (!task)
 		return ERR_PTR(-ESRCH);
 
-	/* Reuse ptrace permission checks for now. */
-	err = -EACCES;
-	if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS))
-		goto errout;
-
 	return task;
-errout:
-	put_task_struct(task);
-	return ERR_PTR(err);
-
 }
 
 /*
@@ -8328,6 +8319,24 @@ SYSCALL_DEFINE5(perf_event_open,
 
 	get_online_cpus();
 
+	if (task) {
+		err = mutex_lock_interruptible(&task->signal->cred_guard_mutex);
+		if (err)
+			goto err_cpus;
+
+		/*
+		 * Reuse ptrace permission checks for now.
+		 *
+		 * We must hold cred_guard_mutex across this and any potential
+		 * perf_install_in_context() call for this new event to
+		 * serialize against exec() altering our credentials (and the
+		 * perf_event_exit_task() that could imply).
+		 */
+		err = -EACCES;
+		if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS))
+			goto err_cred;
+	}
+
 	if (flags & PERF_FLAG_PID_CGROUP)
 		cgroup_fd = pid;
 
@@ -8335,7 +8344,7 @@ SYSCALL_DEFINE5(perf_event_open,
 				 NULL, NULL, cgroup_fd);
 	if (IS_ERR(event)) {
 		err = PTR_ERR(event);
-		goto err_cpus;
+		goto err_cred;
 	}
 
 	if (is_sampling_event(event)) {
@@ -8394,11 +8403,6 @@ SYSCALL_DEFINE5(perf_event_open,
 		goto err_context;
 	}
 
-	if (task) {
-		put_task_struct(task);
-		task = NULL;
-	}
-
 	/*
 	 * Look up the group leader (we will attach this event to it):
 	 */
@@ -8486,6 +8490,11 @@ SYSCALL_DEFINE5(perf_event_open,
 
 	WARN_ON_ONCE(ctx->parent_ctx);
 
+	/*
+	 * This is the point on no return; we cannot fail hereafter. This is
+	 * where we start modifying current state.
+	 */
+
 	if (move_group) {
 		/*
 		 * See perf_event_ctx_lock() for comments on the details
@@ -8555,6 +8564,11 @@ SYSCALL_DEFINE5(perf_event_open,
 		mutex_unlock(&gctx->mutex);
 	mutex_unlock(&ctx->mutex);
 
+	if (task) {
+		mutex_unlock(&task->signal->cred_guard_mutex);
+		put_task_struct(task);
+	}
+
 	put_online_cpus();
 
 	event->owner = current;
@@ -8589,6 +8603,9 @@ err_alloc:
 	 */
 	if (!event_file)
 		free_event(event);
+err_cred:
+	if (task)
+		mutex_unlock(&task->signal->cred_guard_mutex);
 err_cpus:
 	put_online_cpus();
 err_task:
@@ -8868,6 +8885,9 @@ static void perf_event_exit_task_context
 
 /*
  * When a child task exits, feed back event values to parent events.
+ *
+ * Can be called with cred_guard_mutex held when called from
+ * install_exec_creds().
  */
 void perf_event_exit_task(struct task_struct *child)
 {

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.4 00/86] 4.4.12-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 83/86] hpfs: implement the show_options method Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 80/86] SIGNAL: Move generic copy_siginfo() to signal.h Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 70/86] serial: samsung: Reorder the sequence of clock control when call s3c24xx_serial_set_termios() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 63/86] tty: vt, return error when con_startup fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 54/86] USB: leave LPM alone if possible when binding/unbinding interface drivers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 75/86] ALSA: hda - Fix headphone noise on Dell XPS 13 9360 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 73/86] mcb: Fixed bar number assignment for the gdd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 77/86] ALSA: hda - Fix headset mic detection problem for one Dell machine Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 78/86] IB/srp: Fix a debug kernel crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:00 +0200
  [PATCH 4.4 01/86] Btrfs: dont use src fd for printk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:10 +0200
  [PATCH 4.4 49/86] USB: serial: option: add more ZTE device ids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:10 +0200
  [PATCH 4.4 86/86] kbuild: move -Wunused-const-variable to W=1 warning level Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:20 +0200
  [PATCH 4.4 55/86] usb: gadget: udc: core: Fix argument of dev_err() in usb_gadget_map_request() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-30 23:50 +0200
  [PATCH 4.4 02/86] perf/x86/intel/pt: Generate PMI in the STOP region as well Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 47/86] USB: serial: io_edgeport: fix memory leaks in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 11/86] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 43/86] USB: serial: mxuport: fix use-after-free in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 42/86] mei: bus: call mei_cl_read_start under device lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 46/86] USB: serial: io_edgeport: fix memory leaks in attach error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 51/86] usb: gadget: f_fs: Fix EFAULT generation for async read operations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 45/86] USB: serial: quatech2: fix use-after-free in probe error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 41/86] mei: amthif: discard not read messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:00 +0200
  [PATCH 4.4 31/86] mmc: mmc: Fix partition switch timeout for some eMMCs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 15/86] fs/cifs: correctly to anonymous authentication for the LANMAN authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 29/86] irqchip/gic-v3: Configure all interrupts as non-secure Group-1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 06/86] arm64: Fix typo in the pmdp_huge_get_and_clear() definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 13/86] remove directory incorrectly tries to set delete on close on non-empty directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 32/86] mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 19/86] ring-buffer: Use long for nr_pages to avoid overflow failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 03/86] perf/core: Fix perf_event_open() vs. execve() race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 20/86] ring-buffer: Prevent overflow of size in ring_buffer_resize() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 28/86] irqchip/gic: Ensure ordering between read of INTACK and shared data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 05/86] ext4: iterate over buffer heads correctly in move_extent_per_page() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 12/86] kvm: arm64: Fix EC field in inject_abt64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 09/86] arm64: Implement pmdp_set_access_flags() for hardware AF/DBM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 07/86] arm64: Ensure pmd_present() returns false after pmd_mknotpresent() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 36/86] mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 16/86] fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 33/86] ACPI / osi: Fix an issue that acpi_osi=!* cannot disable ACPICA internal strings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 18/86] asix: Fix offset calculation in asix_rx_fixup() causing slow transmissions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 23/86] crypto: sun4i-ss - Replace spinlock_bh by spin_lock_irq{save|restore} Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 38/86] Bluetooth: vhci: purge unhandled skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 27/86] Input: pwm-beeper - fix - scheduling while atomic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 30/86] can: fix handling of unmodifiable configuration options Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 17/86] fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 10/86] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 24/86] clk: qcom: msm8916: Fix crypto clock flags Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 14/86] fs/cifs: correctly to anonymous authentication via NTLMSSP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 22/86] crypto: talitos - fix ahash algorithms registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 08/86] arm64: Implement ptep_set_access_flags() for hardware AF/DBM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  [PATCH 4.4 26/86] mfd: omap-usb-tll: Fix scheduling while atomic BUG Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-31 00:10 +0200
  Re: [PATCH 4.4 00/86] 4.4.12-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-06-01 16:30 +0200

csiph-web