linux-toradex.git/fs/proc/base.c, branch v3.14.3

fs/proc/base.c: fix GPF in /proc/$PID/map_files

2014-03-11T00:26:20+00:00

The expected logic of proc_map_files_get_link() is either to return 0
and initialize 'path' or return an error and leave 'path' uninitialized.

By the time dname_to_vma_addr() returns 0 the corresponding vma may have
already be gone.  In this case the path is not initialized but the
return value is still 0.  This results in 'general protection fault'
inside d_path().

Steps to reproduce:

  CONFIG_CHECKPOINT_RESTORE=y

    fd = open(...);
    while (1) {
        mmap(fd, ...);
        munmap(fd, ...);
    }

  ls -la /proc/$PID/map_files

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=68991

Signed-off-by: Artem Fetishev 
Signed-off-by: Aleksandr Terekhov 
Reported-by: 
Acked-by: Pavel Emelyanov 
Acked-by: Cyrill Gorcunov 
Reviewed-by: "Eric W. Biederman" 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

proc: fix ->f_pos overflows in first_tid()

2014-01-24T00:37:01+00:00

1. proc_task_readdir()->first_tid() path truncates f_pos to int, this
   is wrong even on 64bit.

   We could check that f_pos < PID_MAX or even INT_MAX in
   proc_task_readdir(), but this patch simply checks the potential
   overflow in first_tid(), this check is nop on 64bit.  We do not care if
   it was negative and the new unsigned value is huge, all we need to
   ensure is that we never wrongly return !NULL.

2. Remove the 2nd "nr != 0" check before get_nr_threads(),
   nr_threads == 0 is not distinguishable from !pid_task() above.

Signed-off-by: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Cc: Michal Hocko 
Cc: Sameer Nanda 
Cc: Sergey Dyasly 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

proc: don't (ab)use ->group_leader in proc_task_readdir() paths

2014-01-24T00:37:01+00:00

proc_task_readdir() does not really need "leader", first_tid() has to
revalidate it anyway.  Just pass proc_pid(inode) to first_tid() instead,
it can do pid_task(PIDTYPE_PID) itself and read ->group_leader only if
necessary.

The patch also extracts the "inode is dead" code from
pid_delete_dentry(dentry) into the new trivial helper,
proc_inode_is_dead(inode), proc_task_readdir() uses it to return -ENOENT
if this dir was removed.

This is a bit racy, but the race is very inlikely and the getdents() after
openndir() can see the empty "." + ".." dir only once.

Signed-off-by: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Cc: Michal Hocko 
Cc: Sameer Nanda 
Cc: Sergey Dyasly 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

proc: change first_tid() to use while_each_thread() rather than next_thread()

2014-01-24T00:37:01+00:00

Rerwrite the main loop to use while_each_thread() instead of
next_thread().  We are going to fix or replace while_each_thread(),
next_thread() should be avoided whenever possible.

Signed-off-by: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Cc: Michal Hocko 
Cc: Sameer Nanda 
Cc: Sergey Dyasly 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

proc: fix the potential use-after-free in first_tid()

2014-01-24T00:37:01+00:00

proc_task_readdir() verifies that the result of get_proc_task() is
pid_alive() and thus its ->group_leader is fine too.  However this is not
necessarily true after rcu_read_unlock(), we need to recheck this again
after first_tid() does rcu_read_lock().  Otherwise
leader->thread_group.next (used by next_thread()) can be invalid if the
rcu grace period expires in between.

The race is subtle and unlikely, but still it is possible afaics.  To
simplify lets ignore the "likely" case when tid != 0, f_version can be
cleared by proc_task_operations->llseek().

Suppose we have a main thread M and its subthread T.  Suppose that f_pos
== 3, iow first_tid() should return T.  Now suppose that the following
happens between rcu_read_unlock() and rcu_read_lock():

	1. T execs and becomes the new leader. This removes M from
	    ->thread_group but next_thread(M) is still T.

	2. T creates another thread X which does exec as well, T
	   goes away.

	3. X creates another subthread, this increments nr_threads.

	4. first_tid() does next_thread(M) and returns the already
	   dead T.

Note also that we need 2.  and 3.  only because of get_nr_threads() check,
and this check was supposed to be optimization only.

Signed-off-by: Oleg Nesterov 
Cc: "Eric W. Biederman" 
Cc: Michal Hocko 
Cc: Sameer Nanda 
Cc: Sergey Dyasly 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds

audit: allow unsetting the loginuid (with priv)

2013-11-05T16:08:09+00:00

If a task has CAP_AUDIT_CONTROL allow that task to unset their loginuid.
This would allow a child of that task to set their loginuid without
CAP_AUDIT_CONTROL.  Thus when launching a new login daemon, a
priviledged helper would be able to unset the loginuid and then the
daemon, which may be malicious user facing, do not need priv to function
correctly.

Signed-off-by: Eric Paris 
Signed-off-by: Richard Guy Briggs 
Signed-off-by: Eric Paris

proc_fill_cache(): clean up, get rid of pointless find_inode_number() use

2013-06-29T08:57:19+00:00

Signed-off-by: Al Viro

proc_fill_cache(): just make instantiate_t return int

2013-06-29T08:57:18+00:00

all instances always return ERR_PTR(-E...) or NULL, anyway

Signed-off-by: Al Viro

proc_pid_readdir(): stop wanking with proc_fill_cache() for /proc/self

2013-06-29T08:57:17+00:00

Signed-off-by: Al Viro

proc_fill_cache(): kill pointless check

2013-06-29T08:57:16+00:00

we'd just checked that child->d_inode is non-NULL, for fuck sake!

Signed-off-by: Al Viro