From: Eric W. Biederman Date: Mon, 24 Jan 2022 18:46:50 +0000 (-0600) Subject: ucount: Make get_ucount a safe get_user replacement X-Git-Tag: archive/raspbian/5.15.15-2+rpi1~1^2~14 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=093e0339ee779ac10d87d8dace61961165a813cb;p=linux.git ucount: Make get_ucount a safe get_user replacement Origin: https://git.kernel.org/linus/f9d87929d451d3e649699d0f1d74f71f77ad38f5 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2022-24122 When the ucount code was refactored to create get_ucount it was missed that some of the contexts in which a rlimit is kept elevated can be the only reference to the user/ucount in the system. Ordinary ucount references exist in places that also have a reference to the user namspace, but in POSIX message queues, the SysV shm code, and the SIGPENDING code there is no independent user namespace reference. Inspection of the the user_namespace show no instance of circular references between struct ucounts and the user_namespace. So hold a reference from struct ucount to i's user_namespace to resolve this problem. Link: https://lore.kernel.org/lkml/YZV7Z+yXbsx9p3JN@fixkernel.com/ Reported-by: Qian Cai Reported-by: Mathias Krause Tested-by: Mathias Krause Reviewed-by: Mathias Krause Reviewed-by: Alexey Gladkov Fixes: d64696905554 ("Reimplement RLIMIT_SIGPENDING on top of ucounts") Fixes: 6e52a9f0532f ("Reimplement RLIMIT_MSGQUEUE on top of ucounts") Fixes: d7c9e99aee48 ("Reimplement RLIMIT_MEMLOCK on top of ucounts") Cc: stable@vger.kernel.org Signed-off-by: "Eric W. Biederman" Gbp-Pq: Topic bugfix/all Gbp-Pq: Name ucount-Make-get_ucount-a-safe-get_user-replacement.patch --- diff --git a/kernel/ucount.c b/kernel/ucount.c index 16feb710ee6..804f64799fc 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -184,6 +184,7 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) kfree(new); } else { hlist_add_head(&new->node, hashent); + get_user_ns(new->ns); spin_unlock_irq(&ucounts_lock); return new; } @@ -204,6 +205,7 @@ void put_ucounts(struct ucounts *ucounts) if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) { hlist_del_init(&ucounts->node); spin_unlock_irqrestore(&ucounts_lock, flags); + put_user_ns(ucounts->ns); kfree(ucounts); } }