Commit 293eb1e7 authored by Vasiliy Kulikov's avatar Vasiliy Kulikov Committed by Linus Torvalds

proc: fix a race in do_io_accounting()

If an inode's mode permits opening /proc/PID/io and the resulting file
descriptor is kept across execve() of a setuid or similar binary, the
ptrace_may_access() check tries to prevent using this fd against the
task with escalated privileges.

Unfortunately, there is a race in the check against execve().  If
execve() is processed after the ptrace check, but before the actual io
information gathering, io statistics will be gathered from the
privileged process.  At least in theory this might lead to gathering
sensible information (like ssh/ftp password length) that wouldn't be
available otherwise.

Holding task->signal->cred_guard_mutex while gathering the io
information should protect against the race.

The order of locking is similar to the one inside of ptrace_attach():
first goes cred_guard_mutex, then lock_task_sighand().
Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d2857e79
...@@ -2706,9 +2706,16 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole) ...@@ -2706,9 +2706,16 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
{ {
struct task_io_accounting acct = task->ioac; struct task_io_accounting acct = task->ioac;
unsigned long flags; unsigned long flags;
int result;
if (!ptrace_may_access(task, PTRACE_MODE_READ)) result = mutex_lock_killable(&task->signal->cred_guard_mutex);
return -EACCES; if (result)
return result;
if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
result = -EACCES;
goto out_unlock;
}
if (whole && lock_task_sighand(task, &flags)) { if (whole && lock_task_sighand(task, &flags)) {
struct task_struct *t = task; struct task_struct *t = task;
...@@ -2719,7 +2726,7 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole) ...@@ -2719,7 +2726,7 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
unlock_task_sighand(task, &flags); unlock_task_sighand(task, &flags);
} }
return sprintf(buffer, result = sprintf(buffer,
"rchar: %llu\n" "rchar: %llu\n"
"wchar: %llu\n" "wchar: %llu\n"
"syscr: %llu\n" "syscr: %llu\n"
...@@ -2734,6 +2741,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole) ...@@ -2734,6 +2741,9 @@ static int do_io_accounting(struct task_struct *task, char *buffer, int whole)
(unsigned long long)acct.read_bytes, (unsigned long long)acct.read_bytes,
(unsigned long long)acct.write_bytes, (unsigned long long)acct.write_bytes,
(unsigned long long)acct.cancelled_write_bytes); (unsigned long long)acct.cancelled_write_bytes);
out_unlock:
mutex_unlock(&task->signal->cred_guard_mutex);
return result;
} }
static int proc_tid_io_accounting(struct task_struct *task, char *buffer) static int proc_tid_io_accounting(struct task_struct *task, char *buffer)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment