Eric W. Biederman
117433236a
exec: Transform exec_update_mutex into a rw_semaphore ...
[ Upstream commit f7cfd871ae0c5008d94b6f66834e7845caa93c15 ]
Recently syzbot reported[0] that there is a deadlock amongst the users
of exec_update_mutex. The problematic lock ordering found by lockdep
was:
perf_event_open (exec_update_mutex -> ovl_i_mutex)
chown (ovl_i_mutex -> sb_writes)
sendfile (sb_writes -> p->lock)
by reading from a proc file and writing to overlayfs
proc_pid_syscall (p->lock -> exec_update_mutex)
While looking at possible solutions it occured to me that all of the
users and possible users involved only wanted to state of the given
process to remain the same. They are all readers. The only writer is
exec.
There is no reason for readers to block on each other. So fix
this deadlock by transforming exec_update_mutex into a rw_semaphore
named exec_update_lock that only exec takes for writing.
Cc: Jann Horn <jannh@google.com>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Bernd Edlinger <bernd.edlinger@hotmail.de>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Christopher Yeoh <cyeoh@au1.ibm.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Sargun Dhillon <sargun@sargun.me>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Fixes: eea9673250db ("exec: Add exec_update_mutex to replace cred_guard_mutex")
[0] https://lkml.kernel.org/r/00000000000063640c05ade8e3de@google.com
Reported-by: syzbot+db9cdf3dd1f64252c6ef@syzkaller.appspotmail.com
Link: https://lkml.kernel.org/r/87ft4mbqen.fsf@x220.int.ebiederm.org
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-09 13:44:55 +01:00
can: can_create_echo_skb(): fix echo skb generation: always use skb_clone()
2020-11-18 19:20:19 +01:00
libceph: fix alloc_msg_with_page_vector() memory leaks
2020-04-02 15:11:02 +02:00
net: dsa: tag_8021q: replace dsa_8021q_remove_header with __skb_vlan_pop
2020-04-01 11:01:34 +02:00
gpio: add gpiod_toggle_active_low()
2020-02-19 19:53:09 +01:00
iio: core: remove extra semi-colon from devm_iio_device_register() macro
2020-04-29 16:33:12 +02:00
Input: elan_i2c - add more hardware ID for Lenovo laptops
2020-07-22 09:33:13 +02:00
mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt
2020-06-24 17:50:33 +02:00
net/mlx5: DR, Proper handling of unsupported Connect-X6DX SW steering
2020-12-08 10:40:27 +01:00
mmc: core: Fix size overflow for mmc partitions
2020-10-01 13:17:20 +02:00
mtd: lpddr: Fix bad logic in print_drs_error
2020-11-01 12:01:05 +01:00
netfilter: x_tables: Switch synchronization to RCU
2020-12-30 11:50:54 +01:00
dmaengine: dw: Add DMA-channels mask cell support
2020-10-29 09:58:09 +01:00
ARM: OMAP2+: SmartReflex: add omap_sr_pdata definition
2020-02-01 09:34:49 +00:00
net: qed: Disable aRFS for NPAR and 100G
2020-10-01 13:18:18 +02:00
raid6/test: fix a compilation warning
2020-02-24 08:36:47 +01:00
regulator fix for "regulator: core: Add regulator_is_equal() helper"
2020-02-11 04:35:55 -08:00
exec: Transform exec_update_mutex into a rw_semaphore
2021-01-09 13:44:55 +01:00
spi: Introduce device-managed SPI controller allocation
2020-11-24 13:29:22 +01:00
SUNRPC: xprt_load_transport() needs to support the netid "rdma6"
2020-12-30 11:51:16 +01:00
usb: typec: tcpm: During PR_SWAP, source caps should be sent only after tSwapSourceStart
2020-11-05 11:43:15 +01:00
ACPI: PM: Add acpi_[un]register_wakeup_handler()
2020-04-13 10:48:08 +02:00
ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys()
2020-01-09 10:19:59 +01:00
KVM: arm64: ARM_SMCCC_ARCH_WORKAROUND_1 doesn't return SMCCC_RET_NOT_REQUIRED
2020-11-18 19:20:21 +01:00
bdi: add a ->dev_name field to struct backing_dev_info
2020-05-14 07:58:30 +02:00
bdi: move bdi_dev_name out of line
2020-05-14 07:58:30 +02:00
exec: Add exec_update_mutex to replace cred_guard_mutex
2020-10-01 13:17:47 +02:00
block: add bio_truncate to fix guard_bio_eod
2020-01-09 10:19:54 +01:00
bitfield.h: don't compile-time validate _val in FIELD_FIT
2020-08-19 08:16:28 +02:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
include/linux/bitops.h: avoid clang shift-count-overflow warnings
2020-06-24 17:50:39 +02:00
blk-mq-debugfs: update blk_queue_flag_name[] accordingly for new flags
2020-07-22 09:32:52 +02:00
blktrace: Protect q->blk_trace with RCU
2020-03-05 16:43:52 +01:00
bpf: sockmap: Require attach_bpf_fd when detaching a program
2020-08-07 09:34:02 +02:00
bpf: Limit caller's stack depth 256 for subprogs with tailcalls
2020-10-29 09:58:06 +01:00
ext4: use non-movable memory for superblock readahead
2020-04-23 10:36:15 +02:00
kbuild: avoid static_assert for genksyms
2020-12-16 10:56:58 +01:00
block: allow for_each_bvec to support zero len bvec
2020-09-09 19:12:34 +02:00
cgroup: Fix sock_cgroup_data on big-endian.
2020-07-22 09:32:50 +02:00
cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
2020-07-22 09:32:49 +02:00
futex: Move futex exit handling into futex code
2019-11-29 10:10:08 +01:00
compiler.h: fix barrier_data() on clang
2020-12-16 10:56:59 +01:00
compiler.h: fix barrier_data() on clang
2020-12-16 10:56:59 +01:00
compiler.h: fix barrier_data() on clang
2020-12-16 10:56:59 +01:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE
2020-11-18 19:20:26 +01:00
cpu/hotplug: Ignore pm_wakeup_pending() for disable_nonboot_cpus()
2020-04-17 10:50:11 +02:00
cpufreq: Avoid creating excessively large stack frames
2020-02-11 04:35:25 -08:00
padata: validate cpumask without removed CPU during offline
2020-02-24 08:36:34 +01:00
cpumask: nicer for_each_cpumask_and() signature
2019-09-25 17:51:40 -07:00
dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX
2020-09-23 12:40:47 +02:00
debugfs: Fix !DEBUG_FS debugfs_create_automount
2020-10-01 13:17:21 +02:00
thermal: devfreq_cooling: inline all stubs for CONFIG_DEVFREQ_THERMAL=n
2020-04-17 10:50:09 +02:00
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
dmabuf: use spinlock to access dmabuf->name
2020-07-29 10:18:29 +02:00
dma-direct: check for overflows on 32 bit DMA addresses
2020-01-04 19:17:24 +01:00
dma-mapping: fix handling of dma-ranges for reserved memory (again)
2020-01-04 19:17:00 +01:00
dmaengine: Store module owner in dma_device struct
2020-02-24 08:36:40 +01:00
iommu/vt-d: Silence RCU-list debugging warnings
2020-04-01 11:01:53 +02:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
efi: provide empty efi_enter_virtual_mode implementation
2020-09-03 11:26:49 +02:00
elfnote: mark all .note sections SHF_ALLOC
2020-06-17 16:40:20 +02:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:35:37 -08:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
f2fs: Add a new CP flag to help fsck fix resize SPO issues
2020-04-23 10:36:33 +02:00
fbmem: pull fbcon_update_vcs() out of fb_set_var()
2020-09-03 11:27:09 +02:00
bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()
2020-07-16 08:16:45 +02:00
Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts
2020-10-14 10:32:56 +02:00
writeback: Avoid skipping inode writeback
2020-09-03 11:27:04 +02:00
fscrypt: add fscrypt_is_nokey_name()
2021-01-06 14:48:35 +01:00
fsnotify: replace inode pointer with an object id
2020-05-14 07:58:30 +02:00
futex: Fix inode life-time issue
2020-03-25 08:25:58 +01:00
block/diskstats: more accurate approximation of io_ticks for slow disks
2020-10-07 08:01:29 +02:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
HID: core: Sanitize event code and type when mapping input
2020-09-05 11:22:49 +02:00
hil/parisc: Disable HIL driver when it gets stuck
2020-11-05 11:43:36 +01:00
hrtimer: Annotate lockless access to timer->state
2020-01-04 19:18:41 +01:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS
2020-04-23 10:36:36 +02:00
hwmon: Fix HWMON_P_MIN_ALARM mask
2019-10-02 06:36:50 -07:00
Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
2020-08-11 15:33:38 +02:00
i2c: algo: pca: Reapply i2c bus settings after reset
2020-09-23 12:40:38 +02:00
XArray updates for 5.4
2019-11-08 08:46:49 -08:00
ieee80211: Fix incorrect mask for default PE duration
2020-06-03 08:21:36 +02:00
macvlan: do not assume mac_header is set in macvlan_broadcast()
2020-01-12 12:21:46 +01:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
vlan: consolidate VLAN parsing code and limit max parsing depth
2020-07-22 09:32:49 +02:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
inet_diag: return classid for all socket types
2020-03-18 07:17:38 +01:00
iommu/vt-d: Avoid panic if iommu init fails in tboot system
2020-11-24 13:29:17 +01:00
iommu/vt-d: Fix compile warning from intel-svm.h
2020-02-28 17:22:26 +01:00
augmented rbtree: add new RB_DECLARE_CALLBACKS_MAX macro
2019-09-25 17:51:39 -07:00
io-mapping: indicate mapping failure
2020-07-29 10:18:44 +02:00
lib: devres: add a helper function for ioremap_uc
2020-05-10 10:31:30 +02:00
block: Fix use-after-free issue accessing struct io_cq
2020-04-17 10:50:04 +02:00
/dev/mem: Revoke mappings when a driver claims the region
2020-06-24 17:50:35 +02:00
ipmi: Don't allow device module unload when in use
2019-12-31 16:44:14 +01:00
genirq/affinity: Make affinity setting if activated opt-in
2020-08-21 13:05:20 +02:00
genirq/irqdomain: Add an irq_create_mapping_affinity() function
2020-12-11 13:23:30 +01:00
jbd2: clean __jbd2_journal_abort_hard() and __journal_abort_soft()
2020-06-24 17:50:48 +02:00
kallsyms: Refactor kallsyms_show_value() to take cred
2020-07-16 08:16:44 +02:00
kdev_t: always inline major/minor helper functions
2021-01-09 13:44:54 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:42:53 +01:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
KEYS: Don't write out to userspace while holding key semaphore
2020-04-23 10:36:45 +02:00
kgdb: Fix spurious true from in_dbg_master()
2020-06-22 09:31:03 +02:00
mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged
2020-10-14 10:33:05 +02:00
kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot
2020-10-01 13:18:23 +02:00
KVM: x86: Fix APIC page invalidation race
2020-06-17 16:40:26 +02:00
x86/kvm: Cache gfn to pfn translation
2020-02-11 04:35:40 -08:00
leds: core: Fix leds.h structure documentation
2019-10-08 22:05:58 +02:00
ata: make qc_prep return ata_completion_errors
2020-10-01 13:18:26 +02:00
libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
2020-01-04 19:18:28 +01:00
linkage: Introduce new macros for assembler symbols
2020-11-10 12:37:24 +01:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
include/linux/log2.h: add missing () around n in roundup_pow_of_two()
2020-09-09 19:12:29 +02:00
Merge branch 'next-lockdown' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-09-28 08:14:15 -07:00
mm, memcg: fix inconsistent oom event behavior
2020-05-20 08:20:27 +02:00
mm/memory_hotplug: fix try_offline_node()
2019-11-15 18:34:00 -08:00
mm/memory_hotplug: shrink zones when offlining memory
2020-01-09 10:19:56 +01:00
Revert "Revert "mm, thp: restore node-local hugepage allocations""
2019-09-28 14:05:38 -07:00
libnvdimm fixes v5.4-rc1
2019-09-29 10:33:41 -07:00
memstick: Skip allocating card when removing host
2020-10-07 08:01:25 +02:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: phy: fix write to mii-ctrl1000 register
2019-10-04 18:11:08 -07:00
rfkill: allocate static minor
2019-12-13 08:43:18 +01:00
mm: always have io_remap_pfn_range() set pgprot_decrypted()
2020-11-10 12:37:27 +01:00
mm: thp: handle page cache THP correctly in PageTransCompoundMap
2019-11-06 08:28:58 -08:00
fork: improve error message for corrupted page tables
2019-09-25 17:51:40 -07:00
mm: replace memmap_context by meminit_context
2020-10-07 08:01:29 +02:00
Input: add SW_MACHINE_COVER
2020-07-29 10:18:36 +02:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity
2019-09-27 19:37:27 -07:00
net: introduce helper sendpage_ok() in include/linux/net.h
2020-10-14 10:33:00 +02:00
net: core: reduce recursion limit value
2020-06-30 15:36:44 -04:00
netfilter: clear skb->next in NF_HOOK_LIST()
2020-12-02 08:49:44 +01:00
netfilter: use actual socket sk rather than skb sk when routing harder
2020-11-18 19:20:17 +01:00
netfilter: use actual socket sk rather than skb sk when routing harder
2020-11-18 19:20:17 +01:00
nfs: set invalid blocks after NFSv4 writes
2020-06-24 17:50:44 +02:00
NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests()
2020-10-01 13:17:52 +02:00
NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION
2020-05-06 08:15:05 +02:00
mm: don't rely on system state to detect hot-plug operations
2020-10-07 08:01:30 +02:00
nvme-fc: Revert "add module to ops template to allow module references"
2020-04-17 10:50:10 +02:00
nvme: introduce "Command Aborted By host" status code
2019-12-31 16:44:40 +01:00
nvmem: core: fix nvmem_cell_write inline function
2019-12-31 16:44:43 +01:00
of: fix linker-section match-table corruption
2021-01-06 14:48:37 +01:00
mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary
2020-10-29 09:57:45 +01:00
overflow: Include header file with SIZE_MAX declaration
2020-10-29 09:57:51 +01:00
padata: add separate cpuhp node for CPUHP_PADATA_DEAD
2020-06-17 16:40:22 +02:00
page-flags: fix a crash at SetPageError(THP_SWAP)
2020-03-25 08:25:58 +01:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
mm/page_owner: change split_page_owner to take a count
2020-10-29 09:57:52 +01:00
PCI: endpoint: Fix for concurrent memory allocation in OB address region
2020-04-17 10:50:11 +02:00
PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY
2020-10-29 09:57:54 +01:00
x86/amd_nb: Add AMD family 17h model 60h PCI IDs
2020-06-22 09:31:17 +02:00
percpu: Separate decrypted varaibles anytime encryption can be enabled
2020-02-11 04:35:44 -08:00
percpu_counter: fix a data race at vm_committed_as
2020-04-23 10:36:37 +02:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
net: phy: fix MDIO bus PM PHY resuming
2020-03-18 07:17:46 +01:00
driver code: clarify and fix platform device DMA mask allocation
2020-03-18 07:17:56 +01:00
PM: runtime: Fix timer_expires data type on 32-bit arches
2020-11-01 12:01:06 +01:00
PM / QoS: Redefine FREQ_QOS_MAX_DEFAULT_VALUE to S32_MAX
2019-12-21 11:04:31 +01:00
PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter
2020-12-30 11:50:53 +01:00
pnp: Use list_for_each_entry() instead of open coding
2020-05-20 08:20:27 +02:00
ptp: fix the race between the release of ptp_clock and cdev
2020-01-04 19:18:48 +01:00
random32: make prandom_u32() output unpredictable
2020-11-18 19:20:20 +01:00
i40e: optimise prefetch page refcount
2020-12-30 11:50:55 +01:00
printk: queue wake_up_klogd irq_work only if per-CPU areas are ready
2020-05-02 08:48:42 +02:00
serial: qcom_geni_serial: To correct QUP Version detection logic
2020-11-01 12:01:06 +01:00
fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
2020-01-04 19:17:25 +01:00
quota: Check that quota is not dirty before release
2019-12-17 19:56:43 +01:00
radix tree: Remove radix_tree_iter_find
2019-11-01 22:26:34 -04:00
random32: move the pseudo-random 32-bit definitions to prandom.h
2020-08-07 09:34:01 +02:00
augmented rbtree: rework the RB_DECLARE_CALLBACKS macro definition
2019-09-25 17:51:39 -07:00
rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
2020-02-24 08:36:45 +01:00
reset: fix reset_control_ops kerneldoc comment
2019-10-28 12:18:23 +01:00
reset: fix reset_control_get_exclusive kerneldoc comment
2019-10-24 10:26:33 +02:00
rhashtable: Fix unprotected RCU dereference in __rht_ptr
2020-08-05 09:59:47 +02:00
rwsem: Implement down_read_interruptible
2021-01-09 13:44:55 +01:00
signal: Extend exec_id to 64bits
2020-04-17 10:50:12 +02:00
fix namespaced fscaps when !CONFIG_SECURITY
2020-12-30 11:51:30 +01:00
vt: selection, introduce vc_is_sel
2020-04-02 15:11:00 +02:00
seq_buf: Avoid type mismatch for seq_buf_init
2020-12-30 11:51:21 +01:00
seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier
2020-10-01 13:17:25 +02:00
x86/{mce,mm}: Unmap the entire page if the whole page is affected and poisoned
2020-06-17 16:40:31 +02:00
skbuff: fix a data race in skb_queue_len()
2020-10-01 13:17:31 +02:00
bpf: sockmap: Require attach_bpf_fd when detaching a program
2020-08-07 09:34:02 +02:00
mm, sl[aou]b: guarantee natural alignment for kmalloc(power-of-two)
2019-10-07 15:47:20 -07:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
string.h: fix incompatibility between FORTIFY_SOURCE and KASAN
2020-06-22 09:31:12 +02:00
ACPI: PM: s2idle: Avoid possible race related to the EC GPE
2020-02-19 19:52:56 +01:00
uapi: rename ext2_swab() to swab() and share globally in swab.h
2020-04-13 10:48:07 +02:00
mm: introduce MADV_PAGEOUT
2019-09-25 17:51:41 -07:00
include/linux/swapops.h: correct guards for non_swap_entry()
2020-04-23 10:36:37 +02:00
swiotlb: using SIZE_MAX needs limits.h included
2020-11-24 13:29:04 +01:00
sysfs: Fixes __BIN_ATTR_WO() macro
2019-10-02 10:06:45 +02:00
tcp: allow at most one TLP probe per flight
2020-07-31 18:39:31 +02:00
uaccess: disallow > INT_MAX copy sizes
2020-01-04 19:18:42 +01:00
tcp: fix rejected syncookies due to stale timestamps
2019-12-18 16:08:43 +01:00
time: Prevent undefined behaviour in timespec64_to_ns()
2020-11-18 19:20:15 +01:00
bpf: Fix incorrect verifier simulation of ARSH under ALU32
2020-01-23 08:22:44 +01:00
tpm: Unify the mismatching TPM space buffer sizes
2020-08-19 08:16:27 +02:00
tpm: Require that all digests are present in TCG_PCR_EVENT2 structures
2020-08-19 08:15:57 +02:00
seq_buf: Avoid type mismatch for seq_buf_init
2020-12-30 11:51:21 +01:00
tracepoint: Mark __tracepoint_string's __used
2020-08-19 08:15:53 +02:00
tty: Fix ->session locking
2020-12-11 13:23:28 +01:00
uaccess: Add non-pagefault user-space write function
2020-01-17 19:48:40 +01:00
USB: UAS: introduce a quirk to set no_write_same
2020-12-21 13:27:06 +01:00
net: be more gentle about silly gso requests coming from user
2020-06-10 20:24:55 +02:00
vsock/virtio: add transport parameter to the virtio_transport_reset_no_sock()
2020-10-07 08:01:24 +02:00
vmalloc: fix remap_vmalloc_range() bounds checks
2020-04-29 16:33:14 +02:00
vt: switch vt_dont_switch to bool
2020-04-02 15:11:00 +02:00
xarray: Fix early termination of xas_for_each_marked
2020-04-17 10:50:18 +02:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:33:39 +02:00
mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING
2020-12-16 10:56:59 +01:00
