From 10bde99768d3c92f5fde1ec51f74e926fc4cf779 Mon Sep 17 00:00:00 2001 From: Artem Savkov Date: Thu, 27 Jan 2022 11:44:06 +0100 Subject: [KPATCH CVE-2021-0920] af_unix: fix garbage collect vs MSG_PEEK Kernels: - 3.10.0-1160.15.2.el7 - 3.10.0-1160.21.1.el7 - 3.10.0-1160.24.1.el7 - 3.10.0-1160.25.1.el7 - 3.10.0-1160.31.1.el7 - 3.10.0-1160.36.2.el7 - 3.10.0-1160.41.1.el7 - 3.10.0-1160.42.2.el7 - 3.10.0-1160.45.1.el7 - 3.10.0-1160.49.1.el7 - 3.10.0-1160.53.1.el7 Changes since last build: arches: x86_64 ppc64le - af_unix.o: changed function: unix_dgram_recvmsg - af_unix.o: changed function: unix_stream_read_generic - garbage.o: new function: unix_peek_fds ---- Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-7/-/merge_requests/18 Approved-by: Joe Lawrence (@joe.lawrence) Approved-by: Yannick Cote (@ycote1) Kernels: 3.10.0-1160.21.1.el7 3.10.0-1160.24.1.el7 3.10.0-1160.25.1.el7 3.10.0-1160.31.1.el7 3.10.0-1160.36.2.el7 3.10.0-1160.41.1.el7 3.10.0-1160.42.2.el7 3.10.0-1160.45.1.el7 3.10.0-1160.49.1.el7 3.10.0-1160.53.1.el7 Modifications: moved unix_peek_fds() to net/unix/garbage.c to avoid changing unix_gc_lock scope. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2031986 Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/379 commit ab0fd1713f1efeb2c859d32721625ea98cd9e663 Author: William Zhao Date: Wed Jan 19 09:29:17 2022 -0500 af_unix: fix garbage collect vs MSG_PEEK Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2031970 Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git CVE: CVE-2021-0920 Conflicts: The code still uses the old "sock_iocb" structure since rhel-7 does not have the commit 7cc05662682da ("net: remove sock_iocb"). Thus passing the "scm_cookie" pointer to the "unix_peek_fds" was slightly modified to use "siocb->scm" instead of just "&scm". Additionally the "unix_gc_lock" is not exposed to "af_unix.c" via a header file since rhel-7 does not have the commit f4e65870e5ce ("net: split out functions related to registering inflight socket files"). Bringing in the commit will add a new UNIX_SCM kernel config; this can be avoided by adding extern-ing the "unix_gc_lock". commit cbcf01128d0a92e131bd09f1688fe032480b65ca Author: Miklos Szeredi Date: Wed Jul 28 14:47:20 2021 +0200 af_unix: fix garbage collect vs MSG_PEEK unix_gc() assumes that candidate sockets can never gain an external reference (i.e. be installed into an fd) while the unix_gc_lock is held. Except for MSG_PEEK this is guaranteed by modifying inflight count under the unix_gc_lock. MSG_PEEK does not touch any variable protected by unix_gc_lock (file count is not), yet it needs to be serialized with garbage collection. Do this by locking/unlocking unix_gc_lock: 1) increment file count 2) lock/unlock barrier to make sure incremented file count is visible to garbage collection 3) install file into fd This is a lock barrier (unlike smp_mb()) that ensures that garbage collection is run completely before or completely after the barrier. Cc: Signed-off-by: Greg Kroah-Hartman Signed-off-by: Miklos Szeredi Signed-off-by: Linus Torvalds Signed-off-by: William Zhao Signed-off-by: Artem Savkov --- net/unix/af_unix.c | 7 +++++-- net/unix/garbage.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+), 2 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index bcb0ad54b9b3..a264b4598872 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1468,6 +1468,8 @@ out: return err; } +void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb); + static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) { int i; @@ -2182,7 +2184,8 @@ static int unix_dgram_recvmsg(struct kiocb *iocb, struct socket *sock, sk_peek_offset_fwd(sk, size); if (UNIXCB(skb).fp) - siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(siocb->scm, skb); + } err = (flags & MSG_TRUNC) ? skb->len - skip : size; @@ -2432,7 +2435,7 @@ unlock: /* It is questionable, see note in unix_dgram_recvmsg. */ if (UNIXCB(skb).fp) - siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp); + unix_peek_fds(siocb->scm, skb); sk_peek_offset_fwd(sk, chunk); diff --git a/net/unix/garbage.c b/net/unix/garbage.c index c36757e72844..f242268477ba 100644 --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -374,3 +374,50 @@ void unix_gc(void) out: spin_unlock(&unix_gc_lock); } + +void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) +{ + scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + /* + * Garbage collection of unix sockets starts by selecting a set of + * candidate sockets which have reference only from being in flight + * (total_refs == inflight_refs). This condition is checked once during + * the candidate collection phase, and candidates are marked as such, so + * that non-candidates can later be ignored. While inflight_refs is + * protected by unix_gc_lock, total_refs (file count) is not, hence this + * is an instantaneous decision. + * + * Once a candidate, however, the socket must not be reinstalled into a + * file descriptor while the garbage collection is in progress. + * + * If the above conditions are met, then the directed graph of + * candidates (*) does not change while unix_gc_lock is held. + * + * Any operations that changes the file count through file descriptors + * (dup, close, sendmsg) does not change the graph since candidates are + * not installed in fds. + * + * Dequeing a candidate via recvmsg would install it into an fd, but + * that takes unix_gc_lock to decrement the inflight count, so it's + * serialized with garbage collection. + * + * MSG_PEEK is special in that it does not change the inflight count, + * yet does install the socket into an fd. The following lock/unlock + * pair is to ensure serialization with garbage collection. It must be + * done between incrementing the file count and installing the file into + * an fd. + * + * If garbage collection starts after the barrier provided by the + * lock/unlock, then it will see the elevated refcount and not mark this + * as a candidate. If a garbage collection is already in progress + * before the file count was incremented, then the lock/unlock pair will + * ensure that garbage collection is finished before progressing to + * installing the fd. + * + * (*) A -> B where B is on the queue of A or B is on the queue of C + * which is on the queue of listening socket A. + */ + spin_lock(&unix_gc_lock); + spin_unlock(&unix_gc_lock); +} -- 2.26.3