Blame SOURCES/CVE-2021-4083.patch

392392
From 80c7e812dffa734599aadde93cb8e30b34f0983d Mon Sep 17 00:00:00 2001
392392
From: Joe Lawrence <joe.lawrence@redhat.com>
392392
Date: Mon, 21 Mar 2022 15:45:03 -0400
392392
Subject: [KPATCH CVE-2021-4083] fget: kpatch fixes for CVE-2021-4083
392392
392392
Kernels:
392392
3.10.0-1160.24.1.el7
392392
3.10.0-1160.25.1.el7
392392
3.10.0-1160.31.1.el7
392392
3.10.0-1160.36.2.el7
392392
3.10.0-1160.41.1.el7
392392
3.10.0-1160.42.2.el7
392392
3.10.0-1160.45.1.el7
392392
3.10.0-1160.49.1.el7
392392
3.10.0-1160.53.1.el7
392392
3.10.0-1160.59.1.el7
392392
392392
Changes since last build:
392392
arches: x86_64 ppc64le
392392
file.o: changed function: SyS_dup
392392
file.o: changed function: dup_fd
392392
file.o: changed function: fget
392392
file.o: changed function: fget_light
392392
file.o: changed function: fget_raw
392392
file.o: changed function: fget_raw_light
392392
file.o: changed function: put_files_struct
392392
file.o: new function: __fget
392392
file.o: new function: __fget_light
392392
---------------------------
392392
392392
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/34
392392
Approved-by: Yannick Cote (@ycote1)
392392
Modifications:
392392
- include/linux/rcupdate.h, kernel/rcupdate.c: leave exported
392392
  rcu_my_thread_group_empty() intact
392392
- fs/file.c: use fput() instead of fputs_many() since we skipped commit
392392
  ("fs: add fget_many() and fput_many()")
392392
- fs/file.c: use fcheck_files() instead of files_lookup_fd_raw() since
392392
  we are skipping subsequent commit ("fget: clarify and improve
392392
  __fget_files() implementation") that provides it.
392392
- Set __attribute__((optimize("-fno-optimize-sibling-calls"))) for
392392
  fget() and fget_raw() on ppc64le
392392
392392
commit c2207a235113315ad696b06eb96ccd36d1f5fdeb
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:29 2022 +0100
392392
392392
    introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty()
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
    Conflicts:
392392
            - context difference due to backport of later patch
392392
            - target file difference due to missing backport of rcu source code
392392
              move
392392
392392
    commit a8d4b8345e0ee48b732126d980efaf0dc373e2b0
392392
    Author: Oleg Nesterov <oleg@redhat.com>
392392
    Date:   Sat Jan 11 19:19:32 2014 +0100
392392
392392
        introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty()
392392
392392
        rcu_dereference_check_fdtable() looks very wrong,
392392
392392
        1. rcu_my_thread_group_empty() was added by 844b9a8707f1 "vfs: fix
392392
           RCU-lockdep false positive due to /proc" but it doesn't really
392392
           fix the problem. A CLONE_THREAD (without CLONE_FILES) task can
392392
           hit the same race with get_files_struct().
392392
392392
           And otoh rcu_my_thread_group_empty() can suppress the correct
392392
           warning if the caller is the CLONE_FILES (without CLONE_THREAD)
392392
           task.
392392
392392
        2. files->count == 1 check is not really right too. Even if this
392392
           files_struct is not shared it is not safe to access it lockless
392392
           unless the caller is the owner.
392392
392392
           Otoh, this check is sub-optimal. files->count == 0 always means
392392
           it is safe to use it lockless even if files != current->files,
392392
           but put_files_struct() has to take rcu_read_lock(). See the next
392392
           patch.
392392
392392
        This patch removes the buggy checks and turns fcheck_files() into
392392
        __fcheck_files() which uses rcu_dereference_raw(), the "unshared"
392392
        callers, fget_light() and fget_raw_light(), can use it to avoid
392392
        the warning from RCU-lockdep.
392392
392392
        fcheck_files() is trivially reimplemented as rcu_lockdep_assert()
392392
        plus __fcheck_files().
392392
392392
        Signed-off-by: Oleg Nesterov <oleg@redhat.com>
392392
        Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
commit ec06bac02991edcfdeb148ab2fe7f3e2d7d3ceaa
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:30 2022 +0100
392392
392392
    fs: factor out common code in fget() and fget_raw()
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
    Conflicts:
392392
            - difference due to backport of later patch
392392
392392
    commit 1deb46e2562561255c34075825fd00f22a858bb3
392392
    Author: Oleg Nesterov <oleg@redhat.com>
392392
    Date:   Mon Jan 13 16:48:19 2014 +0100
392392
392392
        fs: factor out common code in fget() and fget_raw()
392392
392392
        Apart from FMODE_PATH check fget() and fget_raw() are identical,
392392
        shift the code into the new simple helper, __fget(fd, mask). Saves
392392
        160 bytes.
392392
392392
        Signed-off-by: Oleg Nesterov <oleg@redhat.com>
392392
        Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
commit ac43fab520f6836e2a7d3d20dd64d6328233ccbe
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:30 2022 +0100
392392
392392
    fs: factor out common code in fget_light() and fget_raw_light()
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
392392
    commit ad46183445043b562856c60b74db664668fb364b
392392
    Author: Oleg Nesterov <oleg@redhat.com>
392392
    Date:   Mon Jan 13 16:48:40 2014 +0100
392392
392392
        fs: factor out common code in fget_light() and fget_raw_light()
392392
392392
        Apart from FMODE_PATH check fget_light() and fget_raw_light() are
392392
        identical, shift the code into the new helper, __fget_light(fd, mask).
392392
        Saves 208 bytes.
392392
392392
        Signed-off-by: Oleg Nesterov <oleg@redhat.com>
392392
        Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
commit 9e24c8894f5df488a336f0c848f15a7d2f78d163
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:30 2022 +0100
392392
392392
    fs: __fget_light() can use __fget() in slow path
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
392392
    commit e6ff9a9fa4e05c1c03dec63cdc6a87d6dea02755
392392
    Author: Oleg Nesterov <oleg@redhat.com>
392392
    Date:   Mon Jan 13 16:49:06 2014 +0100
392392
392392
        fs: __fget_light() can use __fget() in slow path
392392
392392
        The slow path in __fget_light() can use __fget() to avoid the
392392
        code duplication. Saves 232 bytes.
392392
392392
        Signed-off-by: Oleg Nesterov <oleg@redhat.com>
392392
        Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
commit d63fb584ae2d7d9a1620e23e59072cb6929f3833
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:30 2022 +0100
392392
392392
    fs/file.c: __fget() and dup2() atomicity rules
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
392392
    commit 5ba97d2832f87943c43bb69cb1ef86dbc59df5bc
392392
    Author: Eric Dumazet <edumazet@google.com>
392392
    Date:   Mon Jun 29 17:10:30 2015 +0200
392392
392392
        fs/file.c: __fget() and dup2() atomicity rules
392392
392392
        __fget() does lockless fetch of pointer from the descriptor
392392
        table, attempts to grab a reference and treats "it was already
392392
        zero" as "it's already gone from the table, we just hadn't
392392
        seen the store, let's fail".  Unfortunately, that breaks the
392392
        atomicity of dup2() - __fget() might see the old pointer,
392392
        notice that it's been already dropped and treat that as
392392
        "it's closed".  What we should be getting is either the
392392
        old file or new one, depending whether we come before or after
392392
        dup2().
392392
392392
        Dmitry had following test failing sometimes :
392392
392392
        int fd;
392392
        void *Thread(void *x) {
392392
          char buf;
392392
          int n = read(fd, &buf, 1);
392392
          if (n != 1)
392392
            exit(printf("read failed: n=%d errno=%d\n", n, errno));
392392
          return 0;
392392
        }
392392
392392
        int main()
392392
        {
392392
          fd = open("/dev/urandom", O_RDONLY);
392392
          int fd2 = open("/dev/urandom", O_RDONLY);
392392
          if (fd == -1 || fd2 == -1)
392392
            exit(printf("open failed\n"));
392392
          pthread_t th;
392392
          pthread_create(&th, 0, Thread, 0);
392392
          if (dup2(fd2, fd) == -1)
392392
            exit(printf("dup2 failed\n"));
392392
          pthread_join(th, 0);
392392
          if (close(fd) == -1)
392392
            exit(printf("close failed\n"));
392392
          if (close(fd2) == -1)
392392
            exit(printf("close failed\n"));
392392
          printf("DONE\n");
392392
          return 0;
392392
        }
392392
392392
        Signed-off-by: Eric Dumazet <edumazet@google.com>
392392
        Reported-by: Dmitry Vyukov <dvyukov@google.com>
392392
        Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
commit bc04a10c9303dcd9a6305a0452361537257fa0c1
392392
Author: Miklos Szeredi <mszeredi@redhat.com>
392392
Date:   Fri Jan 21 10:22:31 2022 +0100
392392
392392
    fget: check that the fd still exists after getting a ref to it
392392
392392
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2032478
392392
    Upstream status: Linus
392392
    Testing: xfstests
392392
    CVE: CVE-2021-4083
392392
392392
    commit 054aa8d439b9185d4f5eb9a90282d1ce74772969
392392
    Author: Linus Torvalds <torvalds@linux-foundation.org>
392392
    Date:   Wed Dec 1 10:06:14 2021 -0800
392392
392392
        fget: check that the fd still exists after getting a ref to it
392392
392392
        Jann Horn points out that there is another possible race wrt Unix domain
392392
        socket garbage collection, somewhat reminiscent of the one fixed in
392392
        commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK").
392392
392392
        See the extended comment about the garbage collection requirements added
392392
        to unix_peek_fds() by that commit for details.
392392
392392
        The race comes from how we can locklessly look up a file descriptor just
392392
        as it is in the process of being closed, and with the right artificial
392392
        timing (Jann added a few strategic 'mdelay(500)' calls to do that), the
392392
        Unix domain socket garbage collector could see the reference count
392392
        decrement of the close() happen before fget() took its reference to the
392392
        file and the file was attached onto a new file descriptor.
392392
392392
        This is all (intentionally) correct on the 'struct file *' side, with
392392
        RCU lookups and lockless reference counting very much part of the
392392
        design.  Getting that reference count out of order isn't a problem per
392392
        se.
392392
392392
        But the garbage collector can get confused by seeing this situation of
392392
        having seen a file not having any remaining external references and then
392392
        seeing it being attached to an fd.
392392
392392
        In commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK") the
392392
        fix was to serialize the file descriptor install with the garbage
392392
        collector by taking and releasing the unix_gc_lock.
392392
392392
        That's not really an option here, but since this all happens when we are
392392
        in the process of looking up a file descriptor, we can instead simply
392392
        just re-check that the file hasn't been closed in the meantime, and just
392392
        re-do the lookup if we raced with a concurrent close() of the same file
392392
        descriptor.
392392
392392
        Reported-and-tested-by: Jann Horn <jannh@google.com>
392392
        Acked-by: Miklos Szeredi <mszeredi@redhat.com>
392392
        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
392392
392392
    Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
392392
392392
Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>
392392
---
392392
 fs/file.c               | 86 +++++++++++++++--------------------------
392392
 include/linux/fdtable.h | 35 ++++++++++-------
392392
 2 files changed, 53 insertions(+), 68 deletions(-)
392392
392392
diff --git a/fs/file.c b/fs/file.c
392392
index 44bd634b636a..564d60bf0fda 100644
392392
--- a/fs/file.c
392392
+++ b/fs/file.c
392392
@@ -718,42 +718,43 @@ void do_close_on_exec(struct files_struct *files)
392392
 	spin_unlock(&files->file_lock);
392392
 }
392392
 
392392
-struct file *fget(unsigned int fd)
392392
+static struct file *__fget(unsigned int fd, fmode_t mask)
392392
 {
392392
-	struct file *file;
392392
 	struct files_struct *files = current->files;
392392
+	struct file *file;
392392
 
392392
 	rcu_read_lock();
392392
+loop:
392392
 	file = fcheck_files(files, fd);
392392
 	if (file) {
392392
-		/* File object ref couldn't be taken */
392392
-		if (file->f_mode & FMODE_PATH || !get_file_rcu(file))
392392
+		/* File object ref couldn't be taken.
392392
+		 * dup2() atomicity guarantee is the reason
392392
+		 * we loop to catch the new file (or NULL pointer)
392392
+		 */
392392
+		if (file->f_mode & mask)
392392
 			file = NULL;
392392
+		else if (!get_file_rcu(file))
392392
+			goto loop;
392392
+		else if (fcheck_files(files, fd) != file) {
392392
+			fput(file);
392392
+			goto loop;
392392
+		}
392392
 	}
392392
 	rcu_read_unlock();
392392
 
392392
 	return file;
392392
 }
392392
 
392392
+__attribute__((optimize("-fno-optimize-sibling-calls"))) struct file *fget(unsigned int fd)
392392
+{
392392
+	return __fget(fd, FMODE_PATH);
392392
+}
392392
 EXPORT_SYMBOL(fget);
392392
 
392392
-struct file *fget_raw(unsigned int fd)
392392
+__attribute__((optimize("-fno-optimize-sibling-calls"))) struct file *fget_raw(unsigned int fd)
392392
 {
392392
-	struct file *file;
392392
-	struct files_struct *files = current->files;
392392
-
392392
-	rcu_read_lock();
392392
-	file = fcheck_files(files, fd);
392392
-	if (file) {
392392
-		/* File object ref couldn't be taken */
392392
-		if (!atomic_long_inc_not_zero(&file->f_count))
392392
-			file = NULL;
392392
-	}
392392
-	rcu_read_unlock();
392392
-
392392
-	return file;
392392
+	return __fget(fd, 0);
392392
 }
392392
-
392392
 EXPORT_SYMBOL(fget_raw);
392392
 
392392
 /*
392392
@@ -772,56 +773,33 @@ EXPORT_SYMBOL(fget_raw);
392392
  * The fput_needed flag returned by fget_light should be passed to the
392392
  * corresponding fput_light.
392392
  */
392392
-struct file *fget_light(unsigned int fd, int *fput_needed)
392392
+struct file *__fget_light(unsigned int fd, fmode_t mask, int *fput_needed)
392392
 {
392392
-	struct file *file;
392392
 	struct files_struct *files = current->files;
392392
+	struct file *file;
392392
 
392392
 	*fput_needed = 0;
392392
 	if (atomic_read(&files->count) == 1) {
392392
-		file = fcheck_files(files, fd);
392392
-		if (file && (file->f_mode & FMODE_PATH))
392392
+		file = __fcheck_files(files, fd);
392392
+		if (file && (file->f_mode & mask))
392392
 			file = NULL;
392392
 	} else {
392392
-		rcu_read_lock();
392392
-		file = fcheck_files(files, fd);
392392
-		if (file) {
392392
-			if (!(file->f_mode & FMODE_PATH) &&
392392
-			    atomic_long_inc_not_zero(&file->f_count))
392392
-				*fput_needed = 1;
392392
-			else
392392
-				/* Didn't get the reference, someone's freed */
392392
-				file = NULL;
392392
-		}
392392
-		rcu_read_unlock();
392392
+		file = __fget(fd, mask);
392392
+		if (file)
392392
+			*fput_needed = 1;
392392
 	}
392392
 
392392
 	return file;
392392
 }
392392
+struct file *fget_light(unsigned int fd, int *fput_needed)
392392
+{
392392
+	return __fget_light(fd, FMODE_PATH, fput_needed);
392392
+}
392392
 EXPORT_SYMBOL(fget_light);
392392
 
392392
 struct file *fget_raw_light(unsigned int fd, int *fput_needed)
392392
 {
392392
-	struct file *file;
392392
-	struct files_struct *files = current->files;
392392
-
392392
-	*fput_needed = 0;
392392
-	if (atomic_read(&files->count) == 1) {
392392
-		file = fcheck_files(files, fd);
392392
-	} else {
392392
-		rcu_read_lock();
392392
-		file = fcheck_files(files, fd);
392392
-		if (file) {
392392
-			if (atomic_long_inc_not_zero(&file->f_count))
392392
-				*fput_needed = 1;
392392
-			else
392392
-				/* Didn't get the reference, someone's freed */
392392
-				file = NULL;
392392
-		}
392392
-		rcu_read_unlock();
392392
-	}
392392
-
392392
-	return file;
392392
+	return __fget_light(fd, 0, fput_needed);
392392
 }
392392
 
392392
 void set_close_on_exec(unsigned int fd, int flag)
392392
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
392392
index 88d74ca9418f..95bcca7c1a0f 100644
392392
--- a/include/linux/fdtable.h
392392
+++ b/include/linux/fdtable.h
392392
@@ -70,29 +70,36 @@ struct files_struct {
392392
 	RH_KABI_EXTEND(wait_queue_head_t resize_wait)
392392
 };
392392
 
392392
-#define rcu_dereference_check_fdtable(files, fdtfd) \
392392
-	(rcu_dereference_check((fdtfd), \
392392
-			       lockdep_is_held(&(files)->file_lock) || \
392392
-			       atomic_read(&(files)->count) == 1 || \
392392
-			       rcu_my_thread_group_empty()))
392392
-
392392
-#define files_fdtable(files) \
392392
-		(rcu_dereference_check_fdtable((files), (files)->fdt))
392392
-
392392
 struct file_operations;
392392
 struct vfsmount;
392392
 struct dentry;
392392
 
392392
-static inline struct file * fcheck_files(struct files_struct *files, unsigned int fd)
392392
+#define rcu_dereference_check_fdtable(files, fdtfd) \
392392
+	rcu_dereference_check((fdtfd), lockdep_is_held(&(files)->file_lock))
392392
+
392392
+#define files_fdtable(files) \
392392
+	rcu_dereference_check_fdtable((files), (files)->fdt)
392392
+
392392
+/*
392392
+ * The caller must ensure that fd table isn't shared or hold rcu or file lock
392392
+ */
392392
+static inline struct file *__fcheck_files(struct files_struct *files, unsigned int fd)
392392
 {
392392
-	struct file * file = NULL;
392392
-	struct fdtable *fdt = files_fdtable(files);
392392
+	struct fdtable *fdt = rcu_dereference_raw(files->fdt);
392392
 
392392
 	if (fd < fdt->max_fds) {
392392
 		fd = array_index_nospec(fd, fdt->max_fds);
392392
-		file = rcu_dereference_check_fdtable(files, fdt->fd[fd]);
392392
+		return rcu_dereference_raw(fdt->fd[fd]);
392392
 	}
392392
-	return file;
392392
+	return NULL;
392392
+}
392392
+
392392
+static inline struct file *fcheck_files(struct files_struct *files, unsigned int fd)
392392
+{
392392
+	rcu_lockdep_assert(rcu_read_lock_held() ||
392392
+			   lockdep_is_held(&files->file_lock),
392392
+			   "suspicious rcu_dereference_check() usage");
392392
+	return __fcheck_files(files, fd);
392392
 }
392392
 
392392
 /*
392392
-- 
392392
2.26.3
392392
392392