On Mon, Apr 1, 2019 at 4:14 PM Nikolay Borisov <nborisov(a)suse.com> wrote:
> On 1.04.19 г. 12:01 ч., Johannes Thumshirn wrote:
> > Over the last 20 years, the Linux kernel has accumulated hundreds if not
> > thousands of security vulnerabilities.
> >
> > One common pattern in most of these security related reports is processes
> > called "syzkaller", "trinity" or "syz-executor" opening files and then
> > abuse kernel interfaces causing kernel crashes or even worse threats using
> > memory overwrites or by exploiting race conditions.
> >
> > Hunting down these bugs has become time consuming and very expensive, so
> > I've decided to put an end to it.
> >
> > If one of the above mentioned processes tries opening a file, return -EPERM
> > indicating this process does not have the permission to open files on Linux
> > anymore.
> >
> > Signed-off-by: Johannes Thumshirn <jthumshirn(a)suse.de>
>
> Ack-by: Nikolay Borisov <nborisov(a)suse.com>
Reviewed-by: Dmitry Vyukov <dvyukov(a)google.com>
Cc: stable(a)vger.kernel.org # v1.0+
Do we want to extend this to other subsystems?
Should it be a default secomp filter?
> > ---
> > fs/open.c | 14 ++++++++++++++
> > 1 file changed, 14 insertions(+)
> >
> > diff --git a/fs/open.c b/fs/open.c
> > index f1c2f855fd43..3a3b460beccd 100644
> > --- a/fs/open.c
> > +++ b/fs/open.c
> > @@ -1056,6 +1056,20 @@ long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
> > struct open_flags op;
> > int fd = build_open_flags(flags, mode, &op);
> > struct filename *tmp;
> > + char comm[TASK_COMM_LEN];
> > + int i;
> > + static const char * const list[] = {
> > + "syzkaller",
> > + "syz-executor,"
> > + "trinity",
> > + NULL
> > + };
> > +
> > + get_task_comm(comm, current);
> > +
> > + for (i = 0; i < ARRAY_SIZE(list); i++)
> > + if (!strncmp(comm, list[i], strlen(list[i])))
> > + return -EPERM;
> >
> > if (fd)
> > return fd;
> >
Since blk_cleanup_queue() waits until q->q_usage_counter drops to zero
before setting the "dead" flag, it is guaranteed that all requests that
were in progress when blk_cleanup_queue() was called have finished before
the "dead" flag is set. This means it is not possible that any .queue_rq()
call is ongoing while the "dead" flag is set. Hence remove the code that
waits for ongoing .queue_rq() calls to finish after the "dead" flag has
been set. See also commit c2856ae2f315 ("blk-mq: quiesce queue before
freeing queue") # v4.16.
Cc: Christoph Hellwig <hch(a)infradead.org>
Cc: Hannes Reinecke <hare(a)suse.com>
Cc: James Smart <james.smart(a)broadcom.com>
Cc: Ming Lei <ming.lei(a)redhat.com>
Cc: Jianchao Wang <jianchao.w.wang(a)oracle.com>
Cc: Dongli Zhang <dongli.zhang(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Bart Van Assche <bvanassche(a)acm.org>
---
block/blk-core.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/block/blk-core.c b/block/blk-core.c
index bfdbdbb8ec65..2921af6f8d33 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -348,18 +348,6 @@ void blk_cleanup_queue(struct request_queue *q)
blk_queue_flag_set(QUEUE_FLAG_DEAD, q);
- /*
- * make sure all in-progress dispatch are completed because
- * blk_freeze_queue() can only complete all requests, and
- * dispatch may still be in-progress since we dispatch requests
- * from more than one contexts.
- *
- * We rely on driver to deal with the race in case that queue
- * initialization isn't done.
- */
- if (queue_is_mq(q) && blk_queue_init_done(q))
- blk_mq_quiesce_queue(q);
-
/* for synchronous bio-based driver finish in-flight integrity i/o */
blk_flush_integrity();
--
2.21.0.196.g041f5ea1cf98
Change a reference to the legacy block layer into a reference to blk-mq.
Cc: Christoph Hellwig <hch(a)infradead.org>
Cc: Hannes Reinecke <hare(a)suse.com>
Cc: James Smart <james.smart(a)broadcom.com>
Cc: Ming Lei <ming.lei(a)redhat.com>
Cc: Jianchao Wang <jianchao.w.wang(a)oracle.com>
Cc: Dongli Zhang <dongli.zhang(a)oracle.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Bart Van Assche <bvanassche(a)acm.org>
---
block/blk-core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/block/blk-core.c b/block/blk-core.c
index fdcf6de2243f..bfdbdbb8ec65 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -339,7 +339,8 @@ void blk_cleanup_queue(struct request_queue *q)
/*
* Drain all requests queued before DYING marking. Set DEAD flag to
- * prevent that q->request_fn() gets invoked after draining finished.
+ * prevent that blk_mq_run_hw_queues() accesses the hardware queues
+ * after draining finished.
*/
blk_freeze_queue(q);
--
2.21.0.196.g041f5ea1cf98