iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/fs
History
Zhou Chengming 00cf64fbaa sysctl: Drop reference added by grab_header in proc_sys_readdir 
commit 93362fa47fe98b62e4a34ab408c4a418432e7939 upstream.

Fixes CVE-2016-9191, proc_sys_readdir doesn't drop reference
added by grab_header when return from !dir_emit_dots path.
It can cause any path called unregister_sysctl_table will
wait forever.

The calltrace of CVE-2016-9191:

[ 5535.960522] Call Trace:
[ 5535.963265]  [<ffffffff817cdaaf>] schedule+0x3f/0xa0
[ 5535.968817]  [<ffffffff817d33fb>] schedule_timeout+0x3db/0x6f0
[ 5535.975346]  [<ffffffff817cf055>] ? wait_for_completion+0x45/0x130
[ 5535.982256]  [<ffffffff817cf0d3>] wait_for_completion+0xc3/0x130
[ 5535.988972]  [<ffffffff810d1fd0>] ? wake_up_q+0x80/0x80
[ 5535.994804]  [<ffffffff8130de64>] drop_sysctl_table+0xc4/0xe0
[ 5536.001227]  [<ffffffff8130de17>] drop_sysctl_table+0x77/0xe0
[ 5536.007648]  [<ffffffff8130decd>] unregister_sysctl_table+0x4d/0xa0
[ 5536.014654]  [<ffffffff8130deff>] unregister_sysctl_table+0x7f/0xa0
[ 5536.021657]  [<ffffffff810f57f5>] unregister_sched_domain_sysctl+0x15/0x40
[ 5536.029344]  [<ffffffff810d7704>] partition_sched_domains+0x44/0x450
[ 5536.036447]  [<ffffffff817d0761>] ? __mutex_unlock_slowpath+0x111/0x1f0
[ 5536.043844]  [<ffffffff81167684>] rebuild_sched_domains_locked+0x64/0xb0
[ 5536.051336]  [<ffffffff8116789d>] update_flag+0x11d/0x210
[ 5536.057373]  [<ffffffff817cf61f>] ? mutex_lock_nested+0x2df/0x450
[ 5536.064186]  [<ffffffff81167acb>] ? cpuset_css_offline+0x1b/0x60
[ 5536.070899]  [<ffffffff810fce3d>] ? trace_hardirqs_on+0xd/0x10
[ 5536.077420]  [<ffffffff817cf61f>] ? mutex_lock_nested+0x2df/0x450
[ 5536.084234]  [<ffffffff8115a9f5>] ? css_killed_work_fn+0x25/0x220
[ 5536.091049]  [<ffffffff81167ae5>] cpuset_css_offline+0x35/0x60
[ 5536.097571]  [<ffffffff8115aa2c>] css_killed_work_fn+0x5c/0x220
[ 5536.104207]  [<ffffffff810bc83f>] process_one_work+0x1df/0x710
[ 5536.110736]  [<ffffffff810bc7c0>] ? process_one_work+0x160/0x710
[ 5536.117461]  [<ffffffff810bce9b>] worker_thread+0x12b/0x4a0
[ 5536.123697]  [<ffffffff810bcd70>] ? process_one_work+0x710/0x710
[ 5536.130426]  [<ffffffff810c3f7e>] kthread+0xfe/0x120
[ 5536.135991]  [<ffffffff817d4baf>] ret_from_fork+0x1f/0x40
[ 5536.142041]  [<ffffffff810c3e80>] ? kthread_create_on_node+0x230/0x230

One cgroup maintainer mentioned that "cgroup is trying to offline
a cpuset css, which takes place under cgroup_mutex.  The offlining
ends up trying to drain active usages of a sysctl table which apprently
is not happening."
The real reason is that proc_sys_readdir doesn't drop reference added
by grab_header when return from !dir_emit_dots path. So this cpuset
offline path will wait here forever.

See here for details: http://www.openwall.com/lists/oss-security/2016/11/04/13

Fixes: f0c3b5093add ("[readdir] convert procfs")
Reported-by: CAI Qian <caiqian@redhat.com>
Tested-by: Yang Shukui <yangshukui@huawei.com>
Signed-off-by: Zhou Chengming <zhouchengming1@huawei.com>
Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-19 20:18:04 +01:00
..
9p
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
adfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
affs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
afs
afs: call->operation_ID sometimes used as __be32 sometimes as u32
2016-10-13 17:03:52 +01:00
autofs4
autofs: refactor ioctl fn vector in iookup_dev_ioctl()
2016-10-11 15:06:31 -07:00
befs
befs fixes for 4.9-rc1
2016-10-15 12:09:13 -07:00
bfs
Merge remote-tracking branch 'ovl/rename2' into for-linus
2016-10-10 23:02:51 -04:00
btrfs
btrfs: fix crash when tracepoint arguments are freed by wq callbacks
2017-01-19 20:18:02 +01:00
cachefiles
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
ceph
ceph: don't set req->r_locked_dir in ceph_d_revalidate
2016-12-08 14:32:16 +01:00
cifs
CIFS: Fix a possible memory corruption in push locks
2017-01-06 10:40:16 +01:00
coda
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
configfs
Merge remote-tracking branch 'ovl/rename2' into for-linus
2016-10-10 23:02:51 -04:00
cramfs
…
crypto
fscrypt: fix renaming and linking special files
2017-01-12 11:39:06 +01:00
debugfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
devpts
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
dlm
dlm: free workqueues after the connections
2016-10-10 09:54:00 -05:00
ecryptfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
efivarfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
efs
…
exofs
fs: exofs: print a hex number after a 0x prefix
2016-10-27 18:43:43 -07:00
exportfs
exportfs: be careful to only return expected errors.
2016-10-06 09:07:44 -04:00
ext2
ext2: avoid bogus -Wmaybe-uninitialized warning
2016-10-18 11:29:35 +02:00
ext4
ext4: do not perform data journaling when data is encrypted
2017-01-06 10:40:14 +01:00
f2fs
f2fs: hide a maybe-uninitialized warning
2017-01-12 11:39:35 +01:00
fat
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
freevxfs
…
fscache
…
fuse
fuse: fix clearing suid, sgid for chown()
2016-12-06 16:18:45 +01:00
gfs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hfsplus
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hostfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hpfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
hugetlbfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
isofs
isofs: add KERN_CONT to printing of ER records
2016-11-30 10:41:26 -08:00
jbd2
jbd2: fix incorrect unlock on j_list_lock
2016-10-12 23:19:18 -04:00
jffs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
jfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
kernfs
kernfs: Add noop_fsync to supported kernfs_file_fops
2016-10-27 17:47:11 +02:00
lockd
treewide: remove redundant #include <linux/kconfig.h>
2016-10-11 15:06:33 -07:00
logfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
minix
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
ncpfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
nfs
pNFS: Fix a deadlock between read resends and layoutreturn
2017-01-09 08:32:25 +01:00
nfs_common
…
nfsd
nfsd: Fix general protection fault in release_lock_stateid()
2016-11-01 15:24:43 -04:00
nilfs2
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
nls
…
notify
fsnotify: Fix possible use-after-free in inode iteration on umount
2017-01-09 08:32:22 +01:00
ntfs
fs: remove the never implemented aio_fsync file operation
2016-10-30 13:09:42 -04:00
ocfs2
ocfs2: fix crash caused by stale lvb with fsdlm plugin
2017-01-19 20:17:59 +01:00
omfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
openpromfs
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
orangefs
orangefs: add .owner to debugfs file_operations
2016-11-16 11:52:19 -05:00
overlayfs
ovl: fix d_real() for stacked fs
2016-11-29 10:20:24 +01:00
proc
sysctl: Drop reference added by grab_header in proc_sys_readdir
2017-01-19 20:18:04 +01:00
pstore
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
qnx4
…
qnx6
…
quota
quota: fill in Q_XGETQSTAT inode information for inactive quotas
2016-08-15 17:43:31 +02:00
ramfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
reiserfs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
romfs
…
squashfs
vfs: Remove {get,set,remove}xattr inode operations
2016-10-07 21:48:36 -04:00
sysfs
Merge branch 'for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2016-10-14 12:18:50 -07:00
sysv
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
tracefs
fs: Replace CURRENT_TIME with current_time() for inode timestamps
2016-09-27 21:06:21 -04:00
ubifs
ubifs: Fix regression in ubifs_readdir()
2016-10-28 14:48:31 +02:00
udf
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
ufs
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
xfs
xfs: Timely free truncated dirty pages
2017-01-19 20:18:00 +01:00
aio.c
aio: fix freeze protection of aio writes
2016-10-30 13:09:42 -04:00
anon_inodes.c
…
attr.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
bad_inode.c
bad_inode: add missing i_op initializers
2017-01-09 08:32:24 +01:00
binfmt_aout.c
…
binfmt_elf_fdpic.c
elf_fdpic_transfer_args_to_stack(): make it generic
2016-07-25 16:51:49 +10:00
binfmt_elf.c
x86/coredump: Use pr_reg size, rather that TIF_IA32 flag
2016-09-14 21:28:10 +02:00
binfmt_em86.c
fs/binfmt_em86.c: fix incompatible pointer type
2016-08-02 19:35:15 -04:00
binfmt_flat.c
binfmt_flat: allow compressed flat binary format to work on MMU systems
2016-07-28 13:29:12 +10:00
binfmt_misc.c
fs: Replace current_fs_time() with current_time()
2016-09-27 21:06:22 -04:00
binfmt_script.c
…
block_dev.c
block: protect iterate_bdevs() against concurrent close
2017-01-09 08:32:21 +01:00
buffer.c
fs: use mapping_set_error instead of opencoded set_bit
2016-10-11 15:06:33 -07:00
char_dev.c
dax: define a unified inode/address_space for device-dax mappings
2016-08-23 22:58:51 -07:00
compat_binfmt_elf.c
…
compat_ioctl.c
fs: compat_ioctl: add pretimeout functions for watchdogs
2016-09-24 09:27:18 +02:00
compat.c
compat: remove compat_printk()
2016-09-27 21:20:53 -04:00
coredump.c
coredump: fix unfreezable coredumping task
2016-11-11 08:12:37 -08:00
dax.c
thp: reduce usage of huge zero page's atomic counter
2016-10-07 18:46:28 -07:00
dcache.c
mnt: Protect the mountpoint hashtable with mount_lock
2017-01-19 20:18:03 +01:00
dcookies.c
…
direct-io.c
consistent treatment of EFAULT on O_DIRECT read/write
2016-10-03 20:38:55 -04:00
drop_caches.c
…
eventfd.c
…
eventpoll.c
…
exec.c
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
fcntl.c
…
fhandle.c
…
file_table.c
…
file.c
fs/file: more unsigned file descriptors
2016-09-27 18:47:38 -04:00
filesystems.c
…
fs_pin.c
…
fs_struct.c
…
fs-writeback.c
mm, writeback: flush plugged IO in wakeup_flusher_threads()
2016-08-09 19:58:06 -06:00
inode.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
internal.h
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 13:04:49 -07:00
ioctl.c
vfs: cap dedupe request structure size at PAGE_SIZE
2016-09-15 13:29:52 -07:00
iomap.c
fs: Do to trim high file position bits in iomap_page_mkwrite_actor
2016-10-24 14:20:25 +11:00
Kconfig
mm/hugetlb: introduce ARCH_HAS_GIGANTIC_PAGE
2016-10-07 18:46:29 -07:00
Kconfig.binfmt
ARM: 8594/1: enable binfmt_flat on systems with an MMU
2016-08-12 16:47:05 +01:00
libfs.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
locks.c
locking, fs/locks: Add missing file_sem locks
2016-10-18 12:21:28 +02:00
Makefile
…
mbcache.c
mbcache: fix to detect failure of register_shrinker
2016-08-31 11:44:36 -04:00
mount.h
mnt: Add a per mount namespace limit on the number of mounts
2016-09-30 12:46:48 -05:00
mpage.c
block/mm: make bdev_ops->rw_page() take a bool for read/write
2016-08-07 14:41:02 -06:00
namei.c
Merge branch 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs
2016-10-14 17:23:33 -07:00
namespace.c
mnt: Protect the mountpoint hashtable with mount_lock
2017-01-19 20:18:03 +01:00
no-block.c
…
nsfs.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
open.c
xfs: reflink update for 4.9-rc1
2016-10-13 20:28:22 -07:00
pipe.c
pipe: cap initial pipe capacity according to pipe-max-size limit
2016-10-11 15:06:32 -07:00
pnode.c
mnt: Add a per mount namespace limit on the number of mounts
2016-09-30 12:46:48 -05:00
pnode.h
mnt: Add a per mount namespace limit on the number of mounts
2016-09-30 12:46:48 -05:00
posix_acl.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2016-10-10 20:16:43 -07:00
proc_namespace.c
…
read_write.c
iov_iter: kernel-doc import_iovec() and rw_copy_check_uvector()
2016-10-14 20:00:34 -04:00
readdir.c
…
select.c
fs/select: add vmalloc fallback for select(2)
2016-10-11 15:06:30 -07:00
seq_file.c
seq/proc: modify seq_put_decimal_[u]ll to take a const char *, not char
2016-10-07 18:46:30 -07:00
signalfd.c
…
splice.c
splice: reinstate SIGPIPE/EPIPE handling
2017-01-06 10:40:12 +01:00
stack.c
…
stat.c
…
statfs.c
…
super.c
fs/super.c: don't fool lockdep in freeze_super() and thaw_super() paths
2016-10-14 20:41:59 -04:00
sync.c
…
timerfd.c
…
userfaultfd.c
mm: introduce fault_env
2016-07-26 16:19:19 -07:00
utimes.c
Merge remote-tracking branch 'jk/vfs' into work.misc
2016-10-08 11:06:08 -04:00
xattr.c
xattr: Fix setting security xattrs on sockfs
2016-11-17 00:00:23 -05:00