Blame SOURCES/CVE-2020-0466.patch

27a0ef
From c17b58ebffbfa862b3f1815e208db340bd1664eb Mon Sep 17 00:00:00 2001
27a0ef
From: Yannick Cote <ycote@redhat.com>
27a0ef
Date: Tue, 1 Feb 2022 14:14:41 -0500
27a0ef
Subject: [KPATCH CVE-2020-0466] epoll: kpatch fixes for CVE-2020-0466
27a0ef
27a0ef
Kernels:
27a0ef
3.10.0-1160.15.2.el7
27a0ef
3.10.0-1160.21.1.el7
27a0ef
3.10.0-1160.24.1.el7
27a0ef
3.10.0-1160.25.1.el7
27a0ef
3.10.0-1160.31.1.el7
27a0ef
3.10.0-1160.36.2.el7
27a0ef
3.10.0-1160.41.1.el7
27a0ef
3.10.0-1160.42.2.el7
27a0ef
3.10.0-1160.45.1.el7
27a0ef
3.10.0-1160.49.1.el7
27a0ef
3.10.0-1160.53.1.el7
27a0ef
27a0ef
Changes since last build:
27a0ef
[x86_64]:
27a0ef
eventpoll.o: changed function: SyS_epoll_ctl
27a0ef
eventpoll.o: changed function: clear_tfile_check_list
27a0ef
eventpoll.o: changed function: ep_loop_check_proc
27a0ef
27a0ef
[ppc64le]:
27a0ef
eventpoll.o: changed function: SyS_epoll_ctl
27a0ef
eventpoll.o: changed function: ep_loop_check_proc
27a0ef
27a0ef
---------------------------
27a0ef
27a0ef
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/22
27a0ef
Approved-by: Artem Savkov (@artem.savkov)
27a0ef
Kernels:
27a0ef
3.10.0-1160.21.1.el7
27a0ef
3.10.0-1160.24.1.el7
27a0ef
3.10.0-1160.25.1.el7
27a0ef
3.10.0-1160.31.1.el7
27a0ef
3.10.0-1160.36.2.el7
27a0ef
3.10.0-1160.41.1.el7
27a0ef
3.10.0-1160.42.2.el7
27a0ef
3.10.0-1160.45.1.el7
27a0ef
3.10.0-1160.49.1.el7
27a0ef
3.10.0-1160.53.1.el7
27a0ef
27a0ef
Modifications: none
27a0ef
27a0ef
commit f771ed0537c55c506dc846cb8f3da60f6383a2b3
27a0ef
Author: Carlos Maiolino <cmaiolino@redhat.com>
27a0ef
Date:   Sat Dec 18 09:23:31 2021 +0100
27a0ef
27a0ef
    epoll: Keep a reference on files added to the check list
27a0ef
27a0ef
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2042760
27a0ef
    Tested: Sanity check only
27a0ef
    CVE: CVE-2020-0466
27a0ef
27a0ef
    Conflicts:
27a0ef
            - RHEL7 has no support for non-blocking do_epoll_ctl(), so the
27a0ef
              original patch got this part stripped.
27a0ef
27a0ef
    When adding a new fd to an epoll, and that this new fd is an
27a0ef
    epoll fd itself, we recursively scan the fds attached to it
27a0ef
    to detect cycles, and add non-epool files to a "check list"
27a0ef
    that gets subsequently parsed.
27a0ef
27a0ef
    However, this check list isn't completely safe when deletions
27a0ef
    can happen concurrently. To sidestep the issue, make sure that
27a0ef
    a struct file placed on the check list sees its f_count increased,
27a0ef
    ensuring that a concurrent deletion won't result in the file
27a0ef
    disapearing from under our feet.
27a0ef
27a0ef
    Cc: stable@vger.kernel.org
27a0ef
    Signed-off-by: Marc Zyngier <maz@kernel.org>
27a0ef
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
27a0ef
    (cherry picked from commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682)
27a0ef
27a0ef
    Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
27a0ef
27a0ef
commit 0875a380011a7ff7f4504b72890c29fec420d1cd
27a0ef
Author: Carlos Maiolino <cmaiolino@redhat.com>
27a0ef
Date:   Sat Dec 18 09:23:47 2021 +0100
27a0ef
27a0ef
    fix regression in "epoll: Keep a reference on files added to the check list"
27a0ef
27a0ef
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2042760
27a0ef
    Tested: Sanity check only
27a0ef
    CVE: CVE-2020-0466
27a0ef
27a0ef
    epoll_loop_check_proc() can run into a file already committed to destruction;
27a0ef
    we can't grab a reference on those and don't need to add them to the set for
27a0ef
    reverse path check anyway.
27a0ef
27a0ef
    Tested-by: Marc Zyngier <maz@kernel.org>
27a0ef
    Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list")
27a0ef
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
27a0ef
    (cherry picked from commit 77f4689de17c0887775bb77896f4cc11a39bf848)
27a0ef
27a0ef
    Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
27a0ef
27a0ef
Signed-off-by: Yannick Cote <ycote@redhat.com>
27a0ef
---
27a0ef
 fs/eventpoll.c | 13 +++++++++----
27a0ef
 1 file changed, 9 insertions(+), 4 deletions(-)
27a0ef
27a0ef
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
27a0ef
index 6731b99a481f..ca0eb701eeb4 100644
27a0ef
--- a/fs/eventpoll.c
27a0ef
+++ b/fs/eventpoll.c
27a0ef
@@ -1750,9 +1750,11 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
27a0ef
 			 * not already there, and calling reverse_path_check()
27a0ef
 			 * during ep_insert().
27a0ef
 			 */
27a0ef
-			if (list_empty(&epi->ffd.file->f_tfile_llink))
27a0ef
-				list_add(&epi->ffd.file->f_tfile_llink,
27a0ef
-					 &tfile_check_list);
27a0ef
+			if (list_empty(&epi->ffd.file->f_tfile_llink)) {
27a0ef
+				if (get_file_rcu(epi->ffd.file))
27a0ef
+					list_add(&epi->ffd.file->f_tfile_llink,
27a0ef
+						 &tfile_check_list);
27a0ef
+			}
27a0ef
 		}
27a0ef
 	}
27a0ef
 	mutex_unlock(&ep->mtx);
27a0ef
@@ -1796,6 +1798,7 @@ static void clear_tfile_check_list(void)
27a0ef
 		file = list_first_entry(&tfile_check_list, struct file,
27a0ef
 					f_tfile_llink);
27a0ef
 		list_del_init(&file->f_tfile_llink);
27a0ef
+		fput(file);
27a0ef
 	}
27a0ef
 	INIT_LIST_HEAD(&tfile_check_list);
27a0ef
 }
27a0ef
@@ -1951,9 +1954,11 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
27a0ef
 					clear_tfile_check_list();
27a0ef
 					goto error_tgt_fput;
27a0ef
 				}
27a0ef
-			} else
27a0ef
+			} else {
27a0ef
+				get_file(tf.file);
27a0ef
 				list_add(&tf.file->f_tfile_llink,
27a0ef
 							&tfile_check_list);
27a0ef
+			}
27a0ef
 			mutex_lock_nested(&ep->mtx, 0);
27a0ef
 			if (is_file_epoll(tf.file)) {
27a0ef
 				tep = tf.file->private_data;
27a0ef
-- 
27a0ef
2.26.3
27a0ef
27a0ef