yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-virtiofsd-stay-below-fs.file-max-sysctl-value-CVE-20.patch

902636
From 301f19f2ebd617e43e3a8e7bdcf694de580fe689 Mon Sep 17 00:00:00 2001
902636
From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
902636
Date: Tue, 5 May 2020 16:35:56 +0100
902636
Subject: [PATCH 5/9] virtiofsd: stay below fs.file-max sysctl value
902636
 (CVE-2020-10717)
902636
902636
RH-Author: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
Message-id: <20200505163600.22956-4-dgilbert@redhat.com>
902636
Patchwork-id: 96271
902636
O-Subject: [RHEL-AV-8.2.1 qemu-kvm PATCH 3/7] virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)
902636
Bugzilla: 1817445
902636
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
RH-Acked-by: Max Reitz <mreitz@redhat.com>
902636
RH-Acked-by: Michael S. Tsirkin <mst@redhat.com>
902636
902636
From: Stefan Hajnoczi <stefanha@redhat.com>
902636
902636
The system-wide fs.file-max sysctl value determines how many files can
902636
be open.  It defaults to a value calculated based on the machine's RAM
902636
size.  Previously virtiofsd would try to set RLIMIT_NOFILE to 1,000,000
902636
and this allowed the FUSE client to exhaust the number of open files
902636
system-wide on Linux hosts with less than 10 GB of RAM!
902636
902636
Take fs.file-max into account when choosing the default RLIMIT_NOFILE
902636
value.
902636
902636
Fixes: CVE-2020-10717
902636
Reported-by: Yuval Avrahami <yavrahami@paloaltonetworks.com>
902636
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
902636
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
Message-Id: <20200501140644.220940-3-stefanha@redhat.com>
902636
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
902636
(cherry picked from commit 8c1d353d107b4fc344e27f2f08ea7fa25de2eea2)
902636
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
902636
---
902636
 tools/virtiofsd/helper.c | 26 +++++++++++++++++++++++++-
902636
 1 file changed, 25 insertions(+), 1 deletion(-)
902636
902636
diff --git a/tools/virtiofsd/helper.c b/tools/virtiofsd/helper.c
902636
index 9b3eddc..5b222ea 100644
902636
--- a/tools/virtiofsd/helper.c
902636
+++ b/tools/virtiofsd/helper.c
902636
@@ -176,7 +176,8 @@ void fuse_cmdline_help(void)
902636
            "                               default: no_xattr\n"
902636
            "    --rlimit-nofile=<num>      set maximum number of file descriptors\n"
902636
            "                               (0 leaves rlimit unchanged)\n"
902636
-           "                               default: 1,000,000 if the current rlimit is lower\n"
902636
+           "                               default: min(1000000, fs.file-max - 16384)\n"
902636
+           "                                        if the current rlimit is lower\n"
902636
            );
902636
 }
902636
 
902636
@@ -199,9 +200,32 @@ static int fuse_helper_opt_proc(void *data, const char *arg, int key,
902636
 
902636
 static unsigned long get_default_rlimit_nofile(void)
902636
 {
902636
+    g_autofree gchar *file_max_str = NULL;
902636
+    const rlim_t reserved_fds = 16384; /* leave at least this many fds free */
902636
     rlim_t max_fds = 1000000; /* our default RLIMIT_NOFILE target */
902636
+    rlim_t file_max;
902636
     struct rlimit rlim;
902636
 
902636
+    /*
902636
+     * Reduce max_fds below the system-wide maximum, if necessary.  This
902636
+     * ensures there are fds available for other processes so we don't
902636
+     * cause resource exhaustion.
902636
+     */
902636
+    if (!g_file_get_contents("/proc/sys/fs/file-max", &file_max_str,
902636
+                             NULL, NULL)) {
902636
+        fuse_log(FUSE_LOG_ERR, "can't read /proc/sys/fs/file-max\n");
902636
+        exit(1);
902636
+    }
902636
+    file_max = g_ascii_strtoull(file_max_str, NULL, 10);
902636
+    if (file_max < 2 * reserved_fds) {
902636
+        fuse_log(FUSE_LOG_ERR,
902636
+                 "The fs.file-max sysctl is too low (%lu) to allow a "
902636
+                 "reasonable number of open files.\n",
902636
+                 (unsigned long)file_max);
902636
+        exit(1);
902636
+    }
902636
+    max_fds = MIN(file_max - reserved_fds, max_fds);
902636
+
902636
     if (getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
902636
         fuse_log(FUSE_LOG_ERR, "getrlimit(RLIMIT_NOFILE): %m\n");
902636
         exit(1);
902636
-- 
902636
1.8.3.1
902636