Commit 4def1963 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'userns-linus' of... 

Merge branch 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

Pull namespace fixes from Eric Biederman:
 "This is a set of four fairly obvious bug fixes:

   - a switch from d_find_alias to d_find_any_alias because the xattr
     code perversely takes a dentry

   - two mutex vs copy_to_user fixes from Jann Horn

   - a fix to use a sanitized size not the size userspace passed in from
     Christian Brauner"

* 'userns-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace:
  getxattr: use correct xattr length
  sys: don't hold uts_sem while accessing userspace memory
  userns: move user access out of the mutex
  cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()
parents 5e8704ac 82c9a927

arch/alpha/kernel/osf_sys.c

+24 −27
Original line number Diff line number Diff line
@@ -530,24 +530,19 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, const char __user *, path, 
SYSCALL_DEFINE1(osf_utsname, char __user *, name)

{

	int error;

	char tmp[5 * 32];



	down_read(&uts_sem);

	error = -EFAULT;

	if (copy_to_user(name + 0, utsname()->sysname, 32))

		goto out;

	if (copy_to_user(name + 32, utsname()->nodename, 32))

		goto out;

	if (copy_to_user(name + 64, utsname()->release, 32))

		goto out;

	if (copy_to_user(name + 96, utsname()->version, 32))

		goto out;

	if (copy_to_user(name + 128, utsname()->machine, 32))

		goto out;



	error = 0;

 out:

	memcpy(tmp + 0 * 32, utsname()->sysname, 32);

	memcpy(tmp + 1 * 32, utsname()->nodename, 32);

	memcpy(tmp + 2 * 32, utsname()->release, 32);

	memcpy(tmp + 3 * 32, utsname()->version, 32);

	memcpy(tmp + 4 * 32, utsname()->machine, 32);

	up_read(&uts_sem);

	return error;



	if (copy_to_user(name, tmp, sizeof(tmp)))

		return -EFAULT;

	return 0;

}



SYSCALL_DEFINE0(getpagesize)
@@ -567,18 +562,21 @@ SYSCALL_DEFINE2(osf_getdomainname, char __user *, name, int, namelen) 
{

	int len, err = 0;

	char *kname;

	char tmp[32];



	if (namelen > 32)

	if (namelen < 0 || namelen > 32)

		namelen = 32;



	down_read(&uts_sem);

	kname = utsname()->domainname;

	len = strnlen(kname, namelen);

	if (copy_to_user(name, kname, min(len + 1, namelen)))

		err = -EFAULT;

	len = min(len + 1, namelen);

	memcpy(tmp, kname, len);

	up_read(&uts_sem);



	return err;

	if (copy_to_user(name, tmp, len))

		return -EFAULT;

	return 0;

}



/*
@@ -739,13 +737,14 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) 
	};

	unsigned long offset;

	const char *res;

	long len, err = -EINVAL;

	long len;

	char tmp[__NEW_UTS_LEN + 1];



	offset = command-1;

	if (offset >= ARRAY_SIZE(sysinfo_table)) {

		/* Digital UNIX has a few unpublished interfaces here */

		printk("sysinfo(%d)", command);

		goto out;

		return -EINVAL;

	}



	down_read(&uts_sem);
@@ -753,13 +752,11 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count) 
	len = strlen(res)+1;

	if ((unsigned long)len > (unsigned long)count)

		len = count;

	if (copy_to_user(buf, res, len))

		err = -EFAULT;

	else

		err = 0;

	memcpy(tmp, res, len);

	up_read(&uts_sem);

 out:

	return err;

	if (copy_to_user(buf, tmp, len))

		return -EFAULT;

	return 0;

}



SYSCALL_DEFINE5(osf_getsysinfo, unsigned long, op, void __user *, buffer,

arch/sparc/kernel/sys_sparc_32.c

+13 −9
Original line number Diff line number Diff line
@@ -198,6 +198,7 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, 
SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)

{

	int nlen, err;

	char tmp[__NEW_UTS_LEN + 1];



	if (len < 0)

		return -EINVAL;
@@ -207,13 +208,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) 
	nlen = strlen(utsname()->domainname) + 1;

	err = -EINVAL;

	if (nlen > len)

		goto out;

		goto out_unlock;

	memcpy(tmp, utsname()->domainname, nlen);



	err = -EFAULT;

	if (!copy_to_user(name, utsname()->domainname, nlen))

		err = 0;

	up_read(&uts_sem);



out:

	if (copy_to_user(name, tmp, nlen))

		return -EFAULT;

	return 0;



out_unlock:

	up_read(&uts_sem);

	return err;

}

arch/sparc/kernel/sys_sparc_64.c

+12 −8
Original line number Diff line number Diff line
@@ -520,6 +520,7 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs) 
SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)

{

	int nlen, err;

	char tmp[__NEW_UTS_LEN + 1];



	if (len < 0)

		return -EINVAL;
@@ -529,13 +530,16 @@ SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len) 
	nlen = strlen(utsname()->domainname) + 1;

	err = -EINVAL;

	if (nlen > len)

		goto out;

		goto out_unlock;

	memcpy(tmp, utsname()->domainname, nlen);



	err = -EFAULT;

	if (!copy_to_user(name, utsname()->domainname, nlen))

		err = 0;

	up_read(&uts_sem);



out:

	if (copy_to_user(name, tmp, nlen))

		return -EFAULT;

	return 0;



out_unlock:

	up_read(&uts_sem);

	return err;

}

fs/xattr.c

+1 −1
Original line number Diff line number Diff line
@@ -538,7 +538,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, 
	if (error > 0) {

		if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||

		    (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))

			posix_acl_fix_xattr_to_user(kvalue, size);

			posix_acl_fix_xattr_to_user(kvalue, error);

		if (size && copy_to_user(value, kvalue, error))

			error = -EFAULT;

	} else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {

kernel/sys.c

+45 −50
Original line number Diff line number Diff line
@@ -1237,18 +1237,19 @@ static int override_release(char __user *release, size_t len) 


SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)

{

	int errno = 0;

	struct new_utsname tmp;



	down_read(&uts_sem);

	if (copy_to_user(name, utsname(), sizeof *name))

		errno = -EFAULT;

	memcpy(&tmp, utsname(), sizeof(tmp));

	up_read(&uts_sem);

	if (copy_to_user(name, &tmp, sizeof(tmp)))

		return -EFAULT;



	if (!errno && override_release(name->release, sizeof(name->release)))

		errno = -EFAULT;

	if (!errno && override_architecture(name))

		errno = -EFAULT;

	return errno;

	if (override_release(name->release, sizeof(name->release)))

		return -EFAULT;

	if (override_architecture(name))

		return -EFAULT;

	return 0;

}



#ifdef __ARCH_WANT_SYS_OLD_UNAME
@@ -1257,55 +1258,46 @@ SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name) 
 */

SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)

{

	int error = 0;

	struct old_utsname tmp;



	if (!name)

		return -EFAULT;



	down_read(&uts_sem);

	if (copy_to_user(name, utsname(), sizeof(*name)))

		error = -EFAULT;

	memcpy(&tmp, utsname(), sizeof(tmp));

	up_read(&uts_sem);

	if (copy_to_user(name, &tmp, sizeof(tmp)))

		return -EFAULT;



	if (!error && override_release(name->release, sizeof(name->release)))

		error = -EFAULT;

	if (!error && override_architecture(name))

		error = -EFAULT;

	return error;

	if (override_release(name->release, sizeof(name->release)))

		return -EFAULT;

	if (override_architecture(name))

		return -EFAULT;

	return 0;

}



SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)

{

	int error;

	struct oldold_utsname tmp = {};



	if (!name)

		return -EFAULT;

	if (!access_ok(VERIFY_WRITE, name, sizeof(struct oldold_utsname)))

		return -EFAULT;



	down_read(&uts_sem);

	error = __copy_to_user(&name->sysname, &utsname()->sysname,

			       __OLD_UTS_LEN);

	error |= __put_user(0, name->sysname + __OLD_UTS_LEN);

	error |= __copy_to_user(&name->nodename, &utsname()->nodename,

				__OLD_UTS_LEN);

	error |= __put_user(0, name->nodename + __OLD_UTS_LEN);

	error |= __copy_to_user(&name->release, &utsname()->release,

				__OLD_UTS_LEN);

	error |= __put_user(0, name->release + __OLD_UTS_LEN);

	error |= __copy_to_user(&name->version, &utsname()->version,

				__OLD_UTS_LEN);

	error |= __put_user(0, name->version + __OLD_UTS_LEN);

	error |= __copy_to_user(&name->machine, &utsname()->machine,

				__OLD_UTS_LEN);

	error |= __put_user(0, name->machine + __OLD_UTS_LEN);

	memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);

	memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);

	memcpy(&tmp.release, &utsname()->release, __OLD_UTS_LEN);

	memcpy(&tmp.version, &utsname()->version, __OLD_UTS_LEN);

	memcpy(&tmp.machine, &utsname()->machine, __OLD_UTS_LEN);

	up_read(&uts_sem);

	if (copy_to_user(name, &tmp, sizeof(tmp)))

		return -EFAULT;



	if (!error && override_architecture(name))

		error = -EFAULT;

	if (!error && override_release(name->release, sizeof(name->release)))

		error = -EFAULT;

	return error ? -EFAULT : 0;

	if (override_architecture(name))

		return -EFAULT;

	if (override_release(name->release, sizeof(name->release)))

		return -EFAULT;

	return 0;

}

#endif
@@ -1319,17 +1311,18 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) 


	if (len < 0 || len > __NEW_UTS_LEN)

		return -EINVAL;

	down_write(&uts_sem);

	errno = -EFAULT;

	if (!copy_from_user(tmp, name, len)) {

		struct new_utsname *u = utsname();

		struct new_utsname *u;



		down_write(&uts_sem);

		u = utsname();

		memcpy(u->nodename, tmp, len);

		memset(u->nodename + len, 0, sizeof(u->nodename) - len);

		errno = 0;

		uts_proc_notify(UTS_PROC_HOSTNAME);

	}

		up_write(&uts_sem);

	}

	return errno;

}
@@ -1337,8 +1330,9 @@ SYSCALL_DEFINE2(sethostname, char __user *, name, int, len) 


SYSCALL_DEFINE2(gethostname, char __user *, name, int, len)

{

	int i, errno;

	int i;

	struct new_utsname *u;

	char tmp[__NEW_UTS_LEN + 1];



	if (len < 0)

		return -EINVAL;
@@ -1347,11 +1341,11 @@ SYSCALL_DEFINE2(gethostname, char __user *, name, int, len) 
	i = 1 + strlen(u->nodename);

	if (i > len)

		i = len;

	errno = 0;

	if (copy_to_user(name, u->nodename, i))

		errno = -EFAULT;

	memcpy(tmp, u->nodename, i);

	up_read(&uts_sem);

	return errno;

	if (copy_to_user(name, tmp, i))

		return -EFAULT;

	return 0;

}



#endif
@@ -1370,17 +1364,18 @@ SYSCALL_DEFINE2(setdomainname, char __user *, name, int, len) 
	if (len < 0 || len > __NEW_UTS_LEN)

		return -EINVAL;



	down_write(&uts_sem);

	errno = -EFAULT;

	if (!copy_from_user(tmp, name, len)) {

		struct new_utsname *u = utsname();

		struct new_utsname *u;



		down_write(&uts_sem);

		u = utsname();

		memcpy(u->domainname, tmp, len);

		memset(u->domainname + len, 0, sizeof(u->domainname) - len);

		errno = 0;

		uts_proc_notify(UTS_PROC_DOMAINNAME);

	}

		up_write(&uts_sem);

	}

	return errno;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE