Pull seccomp fixes from Kees Cook: "This fixes a rare race condition in seccomp when using TSYNC and USER_NOTIF together where a memory allocation would not get freed (found by syzkaller, fixed by Tycho). Additionally updates Tycho's MAINTAINERS and .mailmap entries for his new address" * tag 'seccomp-v5.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: seccomp: don't leave dangling ->notif if file allocation fails mailmap, MAINTAINERS: move to tycho.pizza seccomp: don't leak memory when filter install races
Unified · Split
| @@ -308,6 +308,7 @@ Tony Luck <tony.luck@intel.com> · 307 unmodified lines | ||
| 308 | 308 | TripleX Chung <xxx.phy@gmail.com> <triplex@zh-kernel.org> |
| 309 | 309 | TripleX Chung <xxx.phy@gmail.com> <zhongyu@18mail.cn> |
| 310 | 310 | Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com> |
| 311 | +Tycho Andersen <tycho@tycho.pizza> <tycho@tycho.ws> | |
| 311 | 312 | Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de> |
| 312 | 313 | Uwe Kleine-König <ukl@pengutronix.de> |
| 313 | 314 | Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com> |
| @@ -9800,7 +9800,7 @@ F: drivers/scsi/53c700* · 9799 unmodified lines | ||
| 9800 | 9800 | |
| 9801 | 9801 | LEAKING_ADDRESSES |
| 9802 | 9802 | M: Tobin C. Harding <me@tobin.cc> |
| 9803 | −M: Tycho Andersen <tycho@tycho.ws> | |
| 9803 | +M: Tycho Andersen <tycho@tycho.pizza> | |
| 9804 | 9804 | L: kernel-hardening@lists.openwall.com |
| 9805 | 9805 | S: Maintained |
| 9806 | 9806 | T: git git://git.kernel.org/pub/scm/linux/kernel/git/tobin/leaks.git |
| @@ -1109,13 +1109,18 @@ out: · 1108 unmodified lines | ||
| 1109 | 1109 | } |
| 1110 | 1110 | |
| 1111 | 1111 | #ifdef CONFIG_SECCOMP_FILTER |
| 1112 | −static int seccomp_notify_release(struct inode *inode, struct file *file) | |
| 1112 | +static void seccomp_notify_free(struct seccomp_filter *filter) | |
| 1113 | +{ | |
| 1114 | + kfree(filter->notif); | |
| 1115 | + filter->notif = NULL; | |
| 1116 | +} | |
| 1117 | + | |
| 1118 | +static void seccomp_notify_detach(struct seccomp_filter *filter) | |
| 1113 | 1119 | { |
| 1114 | − struct seccomp_filter *filter = file->private_data; | |
| 1115 | 1120 | struct seccomp_knotif *knotif; |
| 1116 | 1121 | |
| 1117 | 1122 | if (!filter) |
| 1118 | − return 0; | |
| 1123 | + return; | |
| 1119 | 1124 | |
| 1120 | 1125 | mutex_lock(&filter->notify_lock); |
| 1121 | 1126 | |
| @@ -1139,9 +1144,15 @@ static int seccomp_notify_release(struct inode *inode, struct file *file) · 17 unmodified lines | ||
| 1139 | 1144 | complete(&knotif->ready); |
| 1140 | 1145 | } |
| 1141 | 1146 | |
| 1142 | − kfree(filter->notif); | |
| 1143 | − filter->notif = NULL; | |
| 1147 | + seccomp_notify_free(filter); | |
| 1144 | 1148 | mutex_unlock(&filter->notify_lock); |
| 1149 | +} | |
| 1150 | + | |
| 1151 | +static int seccomp_notify_release(struct inode *inode, struct file *file) | |
| 1152 | +{ | |
| 1153 | + struct seccomp_filter *filter = file->private_data; | |
| 1154 | + | |
| 1155 | + seccomp_notify_detach(filter); | |
| 1145 | 1156 | __put_seccomp_filter(filter); |
| 1146 | 1157 | return 0; |
| 1147 | 1158 | } |
| @@ -1488,7 +1499,7 @@ static struct file *init_listener(struct seccomp_filter *filter) · 340 unmodified lines | ||
| 1488 | 1499 | |
| 1489 | 1500 | out_notif: |
| 1490 | 1501 | if (IS_ERR(ret)) |
| 1491 | − kfree(filter->notif); | |
| 1502 | + seccomp_notify_free(filter); | |
| 1492 | 1503 | out: |
| 1493 | 1504 | return ret; |
| 1494 | 1505 | } |
| @@ -1581,6 +1592,7 @@ out_put_fd: · 86 unmodified lines | ||
| 1581 | 1592 | listener_f->private_data = NULL; |
| 1582 | 1593 | fput(listener_f); |
| 1583 | 1594 | put_unused_fd(listener); |
| 1595 | + seccomp_notify_detach(prepared); | |
| 1584 | 1596 | } else { |
| 1585 | 1597 | fd_install(listener, listener_f); |
| 1586 | 1598 | ret = listener; |