Blame SOURCES/CVE-2021-0920.patch

57a3d0
From 10bde99768d3c92f5fde1ec51f74e926fc4cf779 Mon Sep 17 00:00:00 2001
57a3d0
From: Artem Savkov <asavkov@redhat.com>
57a3d0
Date: Thu, 27 Jan 2022 11:44:06 +0100
57a3d0
Subject: [KPATCH CVE-2021-0920] af_unix: fix garbage collect vs MSG_PEEK
57a3d0
57a3d0
Kernels:
57a3d0
- 3.10.0-1160.15.2.el7
57a3d0
- 3.10.0-1160.21.1.el7
57a3d0
- 3.10.0-1160.24.1.el7
57a3d0
- 3.10.0-1160.25.1.el7
57a3d0
- 3.10.0-1160.31.1.el7
57a3d0
- 3.10.0-1160.36.2.el7
57a3d0
- 3.10.0-1160.41.1.el7
57a3d0
- 3.10.0-1160.42.2.el7
57a3d0
- 3.10.0-1160.45.1.el7
57a3d0
- 3.10.0-1160.49.1.el7
57a3d0
- 3.10.0-1160.53.1.el7
57a3d0
57a3d0
Changes since last build:
57a3d0
57a3d0
arches: x86_64 ppc64le
57a3d0
- af_unix.o: changed function: unix_dgram_recvmsg
57a3d0
- af_unix.o: changed function: unix_stream_read_generic
57a3d0
- garbage.o: new function: unix_peek_fds
57a3d0
----
57a3d0
57a3d0
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/18
57a3d0
Approved-by: Joe Lawrence (@joe.lawrence)
57a3d0
Approved-by: Yannick Cote (@ycote1)
57a3d0
Kernels:
57a3d0
3.10.0-1160.21.1.el7
57a3d0
3.10.0-1160.24.1.el7
57a3d0
3.10.0-1160.25.1.el7
57a3d0
3.10.0-1160.31.1.el7
57a3d0
3.10.0-1160.36.2.el7
57a3d0
3.10.0-1160.41.1.el7
57a3d0
3.10.0-1160.42.2.el7
57a3d0
3.10.0-1160.45.1.el7
57a3d0
3.10.0-1160.49.1.el7
57a3d0
3.10.0-1160.53.1.el7
57a3d0
57a3d0
Modifications: moved unix_peek_fds() to net/unix/garbage.c to avoid
57a3d0
changing unix_gc_lock scope.
57a3d0
57a3d0
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2031986
57a3d0
57a3d0
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/379
57a3d0
57a3d0
commit ab0fd1713f1efeb2c859d32721625ea98cd9e663
57a3d0
Author: William Zhao <wizhao@redhat.com>
57a3d0
Date:   Wed Jan 19 09:29:17 2022 -0500
57a3d0
57a3d0
    af_unix: fix garbage collect vs MSG_PEEK
57a3d0
57a3d0
    Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2031970
57a3d0
    Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
57a3d0
    CVE: CVE-2021-0920
57a3d0
    Conflicts: The code still uses the old "sock_iocb" structure since rhel-7
57a3d0
    does not have the commit 7cc05662682da ("net: remove sock_iocb"). Thus
57a3d0
    passing the "scm_cookie" pointer to the "unix_peek_fds" was slightly
57a3d0
    modified to use "siocb->scm" instead of just "&scm". Additionally
57a3d0
    the "unix_gc_lock" is not exposed to "af_unix.c" via a header file since
57a3d0
    rhel-7 does not have the commit f4e65870e5ce ("net: split out functions
57a3d0
    related to registering inflight socket files"). Bringing in the commit
57a3d0
    will add a new UNIX_SCM kernel config; this can be avoided by adding
57a3d0
    extern-ing the "unix_gc_lock".
57a3d0
57a3d0
    commit cbcf01128d0a92e131bd09f1688fe032480b65ca
57a3d0
    Author: Miklos Szeredi <mszeredi@redhat.com>
57a3d0
    Date:   Wed Jul 28 14:47:20 2021 +0200
57a3d0
57a3d0
        af_unix: fix garbage collect vs MSG_PEEK
57a3d0
57a3d0
        unix_gc() assumes that candidate sockets can never gain an external
57a3d0
        reference (i.e.  be installed into an fd) while the unix_gc_lock is
57a3d0
        held.  Except for MSG_PEEK this is guaranteed by modifying inflight
57a3d0
        count under the unix_gc_lock.
57a3d0
57a3d0
        MSG_PEEK does not touch any variable protected by unix_gc_lock (file
57a3d0
        count is not), yet it needs to be serialized with garbage collection.
57a3d0
        Do this by locking/unlocking unix_gc_lock:
57a3d0
57a3d0
         1) increment file count
57a3d0
57a3d0
         2) lock/unlock barrier to make sure incremented file count is visible
57a3d0
            to garbage collection
57a3d0
57a3d0
         3) install file into fd
57a3d0
57a3d0
        This is a lock barrier (unlike smp_mb()) that ensures that garbage
57a3d0
        collection is run completely before or completely after the barrier.
57a3d0
57a3d0
        Cc: <stable@vger.kernel.org>
57a3d0
        Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
57a3d0
        Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
57a3d0
        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
57a3d0
    Signed-off-by: William Zhao <wizhao@redhat.com>
57a3d0
57a3d0
Signed-off-by: Artem Savkov <asavkov@redhat.com>
57a3d0
---
57a3d0
 net/unix/af_unix.c |  7 +++++--
57a3d0
 net/unix/garbage.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++
57a3d0
 2 files changed, 52 insertions(+), 2 deletions(-)
57a3d0
57a3d0
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
57a3d0
index bcb0ad54b9b3..a264b4598872 100644
57a3d0
--- a/net/unix/af_unix.c
57a3d0
+++ b/net/unix/af_unix.c
57a3d0
@@ -1468,6 +1468,8 @@ out:
57a3d0
 	return err;
57a3d0
 }
57a3d0
 
57a3d0
+void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb);
57a3d0
+
57a3d0
 static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
57a3d0
 {
57a3d0
 	int i;
57a3d0
@@ -2182,7 +2184,8 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock,
57a3d0
 		sk_peek_offset_fwd(sk, size);
57a3d0
 
57a3d0
 		if (UNIXCB(skb).fp)
57a3d0
-			siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
57a3d0
+			unix_peek_fds(siocb->scm, skb);
57a3d0
+
57a3d0
 	}
57a3d0
 	err = (flags & MSG_TRUNC) ? skb->len - skip : size;
57a3d0
 
57a3d0
@@ -2432,7 +2435,7 @@ unlock:
57a3d0
 			/* It is questionable, see note in unix_dgram_recvmsg.
57a3d0
 			 */
57a3d0
 			if (UNIXCB(skb).fp)
57a3d0
-				siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
57a3d0
+				unix_peek_fds(siocb->scm, skb);
57a3d0
 
57a3d0
 			sk_peek_offset_fwd(sk, chunk);
57a3d0
 
57a3d0
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
57a3d0
index c36757e72844..f242268477ba 100644
57a3d0
--- a/net/unix/garbage.c
57a3d0
+++ b/net/unix/garbage.c
57a3d0
@@ -374,3 +374,50 @@ void unix_gc(void)
57a3d0
  out:
57a3d0
 	spin_unlock(&unix_gc_lock);
57a3d0
 }
57a3d0
+
57a3d0
+void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb)
57a3d0
+{
57a3d0
+	scm->fp = scm_fp_dup(UNIXCB(skb).fp);
57a3d0
+
57a3d0
+	/*
57a3d0
+	 * Garbage collection of unix sockets starts by selecting a set of
57a3d0
+	 * candidate sockets which have reference only from being in flight
57a3d0
+	 * (total_refs == inflight_refs).  This condition is checked once during
57a3d0
+	 * the candidate collection phase, and candidates are marked as such, so
57a3d0
+	 * that non-candidates can later be ignored.  While inflight_refs is
57a3d0
+	 * protected by unix_gc_lock, total_refs (file count) is not, hence this
57a3d0
+	 * is an instantaneous decision.
57a3d0
+	 *
57a3d0
+	 * Once a candidate, however, the socket must not be reinstalled into a
57a3d0
+	 * file descriptor while the garbage collection is in progress.
57a3d0
+	 *
57a3d0
+	 * If the above conditions are met, then the directed graph of
57a3d0
+	 * candidates (*) does not change while unix_gc_lock is held.
57a3d0
+	 *
57a3d0
+	 * Any operations that changes the file count through file descriptors
57a3d0
+	 * (dup, close, sendmsg) does not change the graph since candidates are
57a3d0
+	 * not installed in fds.
57a3d0
+	 *
57a3d0
+	 * Dequeing a candidate via recvmsg would install it into an fd, but
57a3d0
+	 * that takes unix_gc_lock to decrement the inflight count, so it's
57a3d0
+	 * serialized with garbage collection.
57a3d0
+	 *
57a3d0
+	 * MSG_PEEK is special in that it does not change the inflight count,
57a3d0
+	 * yet does install the socket into an fd.  The following lock/unlock
57a3d0
+	 * pair is to ensure serialization with garbage collection.  It must be
57a3d0
+	 * done between incrementing the file count and installing the file into
57a3d0
+	 * an fd.
57a3d0
+	 *
57a3d0
+	 * If garbage collection starts after the barrier provided by the
57a3d0
+	 * lock/unlock, then it will see the elevated refcount and not mark this
57a3d0
+	 * as a candidate.  If a garbage collection is already in progress
57a3d0
+	 * before the file count was incremented, then the lock/unlock pair will
57a3d0
+	 * ensure that garbage collection is finished before progressing to
57a3d0
+	 * installing the fd.
57a3d0
+	 *
57a3d0
+	 * (*) A -> B where B is on the queue of A or B is on the queue of C
57a3d0
+	 * which is on the queue of listening socket A.
57a3d0
+	 */
57a3d0
+	spin_lock(&unix_gc_lock);
57a3d0
+	spin_unlock(&unix_gc_lock);
57a3d0
+}
57a3d0
-- 
57a3d0
2.26.3
57a3d0
57a3d0