From 18c390171a63c1be8df1a62172214efbd9e84813 Mon Sep 17 00:00:00 2001

From: Joe Lawrence <joe.lawrence@redhat.com>

Date: Thu, 20 Jan 2022 14:39:19 -0500

Subject: [KPATCH CVE-2021-0920] af_unix: kpatch fixes for CVE-2021-0920

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Changes since last build:

arches: x86_64 ppc64le

af_unix.o: changed function: unix_dgram_recvmsg

af_unix.o: changed function: unix_stream_read_generic

---------------------------

Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/17

Approved-by: Yannick Cote (@ycote1)

Approved-by: Artem Savkov (@artem.savkov)

Kernels:

4.18.0-348.el8

4.18.0-348.2.1.el8_5

4.18.0-348.7.1.el8_5

4.18.0-348.12.2.el8_5

Modifications: none

commit 49c79494c048e940be91a9454c2f507bc33680fc

Author: Patrick Talbert <ptalbert@redhat.com>

Date:   Mon Jan 10 13:13:05 2022 +0100

    af_unix: fix garbage collect vs MSG_PEEK

    Bugzilla: https://bugzilla.redhat.com/2031974

    CVE: CVE-2021-0920

    Y-Commit: 35c0f6eeb4644e87e7f3c1198a9f31b76220053d

    O-CVE: CVE-2021-0920

    O-Bugzilla: https://bugzilla.redhat.com/2031975

    Upstream status: main

    Testing: Sanity only

    commit cbcf01128d0a92e131bd09f1688fe032480b65ca

    Author: Miklos Szeredi <mszeredi@redhat.com>

    Date:   Wed Jul 28 14:47:20 2021 +0200

        af_unix: fix garbage collect vs MSG_PEEK

        unix_gc() assumes that candidate sockets can never gain an external

        reference (i.e.  be installed into an fd) while the unix_gc_lock is

        held.  Except for MSG_PEEK this is guaranteed by modifying inflight

        count under the unix_gc_lock.

        MSG_PEEK does not touch any variable protected by unix_gc_lock (file

        count is not), yet it needs to be serialized with garbage collection.

        Do this by locking/unlocking unix_gc_lock:

         1) increment file count

         2) lock/unlock barrier to make sure incremented file count is visible

            to garbage collection

         3) install file into fd

        This is a lock barrier (unlike smp_mb()) that ensures that garbage

        collection is run completely before or completely after the barrier.

        Cc: <stable@vger.kernel.org>

        Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

        Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>

        Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

    Signed-off-by: Patrick Talbert <ptalbert@redhat.com>

Signed-off-by: Joe Lawrence <joe.lawrence@redhat.com>

---

 net/unix/af_unix.c | 51 ++++++++++++++++++++++++++++++++++++++++++++--

 1 file changed, 49 insertions(+), 2 deletions(-)

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c

index 247e3138d1ef..d9c968caaf20 100644

--- a/net/unix/af_unix.c

+++ b/net/unix/af_unix.c

@@ -1498,6 +1498,53 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int peer)

 	return err;

 }

+static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb)

+{

+	scm->fp = scm_fp_dup(UNIXCB(skb).fp);

+

+	/*

+	 * Garbage collection of unix sockets starts by selecting a set of

+	 * candidate sockets which have reference only from being in flight

+	 * (total_refs == inflight_refs).  This condition is checked once during

+	 * the candidate collection phase, and candidates are marked as such, so

+	 * that non-candidates can later be ignored.  While inflight_refs is

+	 * protected by unix_gc_lock, total_refs (file count) is not, hence this

+	 * is an instantaneous decision.

+	 *

+	 * Once a candidate, however, the socket must not be reinstalled into a

+	 * file descriptor while the garbage collection is in progress.

+	 *

+	 * If the above conditions are met, then the directed graph of

+	 * candidates (*) does not change while unix_gc_lock is held.

+	 *

+	 * Any operations that changes the file count through file descriptors

+	 * (dup, close, sendmsg) does not change the graph since candidates are

+	 * not installed in fds.

+	 *

+	 * Dequeing a candidate via recvmsg would install it into an fd, but

+	 * that takes unix_gc_lock to decrement the inflight count, so it's

+	 * serialized with garbage collection.

+	 *

+	 * MSG_PEEK is special in that it does not change the inflight count,

+	 * yet does install the socket into an fd.  The following lock/unlock

+	 * pair is to ensure serialization with garbage collection.  It must be

+	 * done between incrementing the file count and installing the file into

+	 * an fd.

+	 *

+	 * If garbage collection starts after the barrier provided by the

+	 * lock/unlock, then it will see the elevated refcount and not mark this

+	 * as a candidate.  If a garbage collection is already in progress

+	 * before the file count was incremented, then the lock/unlock pair will

+	 * ensure that garbage collection is finished before progressing to

+	 * installing the fd.

+	 *

+	 * (*) A -> B where B is on the queue of A or B is on the queue of C

+	 * which is on the queue of listening socket A.

+	 */

+	spin_lock(&unix_gc_lock);

+	spin_unlock(&unix_gc_lock);

+}

+

 static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)

 {

 	int err = 0;

@@ -2124,7 +2171,7 @@ static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg,

 		sk_peek_offset_fwd(sk, size);

 		if (UNIXCB(skb).fp)

-			scm.fp = scm_fp_dup(UNIXCB(skb).fp);

+			unix_peek_fds(&scm, skb);

 	}

 	err = (flags & MSG_TRUNC) ? skb->len - skip : size;

@@ -2365,7 +2412,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,

 			/* It is questionable, see note in unix_dgram_recvmsg.

 			 */

 			if (UNIXCB(skb).fp)

-				scm.fp = scm_fp_dup(UNIXCB(skb).fp);

+				unix_peek_fds(&scm, skb);

 			sk_peek_offset_fwd(sk, chunk);

-- 

2.34.1