Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1233511

[PATCH 4.1 004/159] unshare: Unsharing a thread does not require unsharing a vm

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.1 004/159] unshare: Unsharing a thread does not require unsharing a vm
Date 2015-09-27 00:00 +0200
Message-ID <qd5FG-445-59@gated-at.bofh.it> (permalink)
References <qd4Tf-384-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Eric W. Biederman" <ebiederm@xmission.com>

commit 12c641ab8270f787dfcce08b5f20ce8b65008096 upstream.

In the logic in the initial commit of unshare made creating a new
thread group for a process, contingent upon creating a new memory
address space for that process.  That is wrong.  Two separate
processes in different thread groups can share a memory address space
and clone allows creation of such proceses.

This is significant because it was observed that mm_users > 1 does not
mean that a process is multi-threaded, as reading /proc/PID/maps
temporarily increments mm_users, which allows other processes to
(accidentally) interfere with unshare() calls.

Correct the check in check_unshare_flags() to test for
!thread_group_empty() for CLONE_THREAD, CLONE_SIGHAND, and CLONE_VM.
For sighand->count > 1 for CLONE_SIGHAND and CLONE_VM.
For !current_is_single_threaded instead of mm_users > 1 for CLONE_VM.

By using the correct checks in unshare this removes the possibility of
an accidental denial of service attack.

Additionally using the correct checks in unshare ensures that only an
explicit unshare(CLONE_VM) can possibly trigger the slow path of
current_is_single_threaded().  As an explict unshare(CLONE_VM) is
pointless it is not expected there are many applications that make
that call.

Fixes: b2e0d98705e60e45bbb3c0032c48824ad7ae0704 userns: Implement unshare of the user namespace
Reported-by: Ricky Zhou <rickyz@chromium.org>
Reported-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/fork.c |   28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1854,13 +1854,21 @@ static int check_unshare_flags(unsigned
 				CLONE_NEWUSER|CLONE_NEWPID))
 		return -EINVAL;
 	/*
-	 * Not implemented, but pretend it works if there is nothing to
-	 * unshare. Note that unsharing CLONE_THREAD or CLONE_SIGHAND
-	 * needs to unshare vm.
+	 * Not implemented, but pretend it works if there is nothing
+	 * to unshare.  Note that unsharing the address space or the
+	 * signal handlers also need to unshare the signal queues (aka
+	 * CLONE_THREAD).
 	 */
 	if (unshare_flags & (CLONE_THREAD | CLONE_SIGHAND | CLONE_VM)) {
-		/* FIXME: get_task_mm() increments ->mm_users */
-		if (atomic_read(&current->mm->mm_users) > 1)
+		if (!thread_group_empty(current))
+			return -EINVAL;
+	}
+	if (unshare_flags & (CLONE_SIGHAND | CLONE_VM)) {
+		if (atomic_read(&current->sighand->count) > 1)
+			return -EINVAL;
+	}
+	if (unshare_flags & CLONE_VM) {
+		if (!current_is_single_threaded())
 			return -EINVAL;
 	}
 
@@ -1929,16 +1937,16 @@ SYSCALL_DEFINE1(unshare, unsigned long,
 	if (unshare_flags & CLONE_NEWUSER)
 		unshare_flags |= CLONE_THREAD | CLONE_FS;
 	/*
-	 * If unsharing a thread from a thread group, must also unshare vm.
-	 */
-	if (unshare_flags & CLONE_THREAD)
-		unshare_flags |= CLONE_VM;
-	/*
 	 * If unsharing vm, must also unshare signal handlers.
 	 */
 	if (unshare_flags & CLONE_VM)
 		unshare_flags |= CLONE_SIGHAND;
 	/*
+	 * If unsharing a signal handlers, must also unshare the signal queues.
+	 */
+	if (unshare_flags & CLONE_SIGHAND)
+		unshare_flags |= CLONE_THREAD;
+	/*
 	 * If unsharing namespace, must also unshare filesystem information.
 	 */
 	if (unshare_flags & CLONE_NEWNS)


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.1 000/159] 4.1.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 087/159] md/raid10: always set reshape_safe when initializing reshape_position. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 090/159] iommu/io-pgtable-arm: Unmap and free table when overwriting with block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 042/159] powerpc/mm: Recompute hash value after a failed update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 040/159] crypto: vmx - Adding enable_kernel_vsx() to access VSX instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 044/159] Add radeon suspend/resume quirk for HP Compaq dc5750. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 078/159] parisc: Filter out spurious interrupts in PA-RISC irq handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 037/159] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 062/159] NFS41/flexfiles: update inode after write finishes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 038/159] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 021/159] arm64: head.S: initialise mdcr_el2 in el2_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 015/159] Revert "ext4: remove block_device_ejected" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 066/159] NFSv4.1: Fix a protocol issue with CLOSE stateids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 031/159] ALSA: hda - Add some FIXUP quirks for white noise on Dell laptop. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 029/159] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 065/159] NFSv4.1/flexfiles: Fix a protocol error in layoutreturn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 020/159] arm64: compat: fix vfp save/restore across signal handlers in big-endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 064/159] NFS41/flexfiles: zero out DS write wcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 039/159] powerpc: Uncomment and make enable_kernel_vsx() routine available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 067/159] Revert "NFSv4: Remove incorrect check in can_open_delegated()" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 035/159] powerpc/eeh: Probe after unbalanced kref check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 030/159] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 089/159] iommu/fsl: Really fix init section(s) content Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 041/159] powerpc/boot: Specify ABI v2 when building an LE boot wrapper Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 012/159] cxl: Remove racy attempt to force EEH invocation in reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 063/159] NFSv4: Force a post-op attribute update when holding a delegation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 036/159] powerpc/eeh: Fix fenced PHB caused by eeh_slot_error_detail() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-26 23:50 +0200
  [PATCH 4.1 011/159] mac80211: enable assoc check for mesh interfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 005/159] rtlwifi: rtl8192cu: Add new device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 013/159] cxl: Fix unbalanced pci_dev_get in cxl_probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 008/159] tg3: Fix temperature reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 010/159] MIPS: math-emu: Emulate missing BC1{EQ,NE}Z instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 007/159] igb: Fix oops caused by missing queue pairing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 001/159] NFC: st21nfca: fix use of uninitialized variables in error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 018/159] of/fdt: make memblock maximum physical address arch configurable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 014/159] ext4: dont manipulate recovery flag when freezing no-journal fs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 006/159] rtlwifi: rtl8821ae: Fix an expression that is always false Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 004/159] unshare: Unsharing a thread does not require unsharing a vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 017/159] arm64: flush FP/SIMD state correctly after execve() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 003/159] blk-mq: fix buffer overflow when reading sysfs file of pending Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  [PATCH 4.1 002/159] nfc: nci: hci: Add check on skb nci_hci_send_cmd parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 00:00 +0200
  Re: [PATCH 4.1 000/159] 4.1.9-stable review (build error) Guenter Roeck <linux@roeck-us.net> - 2015-09-27 02:40 +0200
    [PATCH] cxl: Don't remove AFUs/vPHBs in cxl_reset Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-27 08:50 +0200
      Re: [PATCH] cxl: Don't remove AFUs/vPHBs in cxl_reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 17:40 +0200
      Re: [PATCH] cxl: Don't remove AFUs/vPHBs in cxl_reset Daniel Axtens <dja@axtens.net> - 2015-09-29 07:30 +0200
  Re: [PATCH 4.1 000/159] 4.1.9-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-27 21:20 +0200
    Re: [PATCH 4.1 000/159] 4.1.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-27 21:40 +0200
  Re: [PATCH 4.1 000/159] 4.1.9-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-28 07:10 +0200
    Re: [PATCH 4.1 000/159] 4.1.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-28 16:30 +0200
  Re: [PATCH 4.1 000/159] 4.1.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-09-28 19:40 +0200
    Re: [PATCH 4.1 000/159] 4.1.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-28 23:40 +0200
  Re: [PATCH 4.1 000/159] 4.1.9-stable review "Andre Tomt (LKML)" <lkml@tomt.net> - 2015-09-29 03:00 +0200

csiph-web