Skip to content

Commit

Permalink
user namespace: usb: make usb urbs user namespace aware (v2)
Browse files Browse the repository at this point in the history 
Add to the dev_state and alloc_async structures the user namespace
corresponding to the uid and euid.  Pass these to kill_pid_info_as_uid(),
which can then implement a proper, user-namespace-aware uid check.

Changelog:
Sep 20: Per Oleg's suggestion: Instead of caching and passing user namespace,
	uid, and euid each separately, pass a struct cred.
Sep 26: Address Alan Stern's comments: don't define a struct cred at
	usbdev_open(), and take and put a cred at async_completed() to
	ensure it lasts for the duration of kill_pid_info_as_cred().

Signed-off-by: Serge Hallyn <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: "Eric W. Biederman" <[email protected]>
Cc: Tejun Heo <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
  • Loading branch information
@hallyn @gregkh
hallyn authored and gregkh committed Sep 29, 2011
1 parent edb2b25 commit d178bc3
Show file tree
Hide file tree
Showing 3 changed files with 31 additions and 26 deletions.
30 changes: 13 additions & 17 deletions drivers/usb/core/devio.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@
#include <linux/cdev.h>
#include <linux/notifier.h>
#include <linux/security.h>
#include <linux/user_namespace.h>
#include <asm/uaccess.h>
#include <asm/byteorder.h>
#include <linux/moduleparam.h>
Expand All @@ -68,7 +69,7 @@ struct dev_state {
wait_queue_head_t wait; /* wake up if a request completed */
unsigned int discsignr;
struct pid *disc_pid;
uid_t disc_uid, disc_euid;
const struct cred *cred;
void __user *disccontext;
unsigned long ifclaimed;
u32 secid;
Expand All @@ -79,7 +80,7 @@ struct async {
struct list_head asynclist;
struct dev_state *ps;
struct pid *pid;
uid_t uid, euid;
const struct cred *cred;
unsigned int signr;
unsigned int ifnum;
void __user *userbuffer;
Expand Down Expand Up @@ -248,6 +249,7 @@ static struct async *alloc_async(unsigned int numisoframes)
static void free_async(struct async *as)
{
put_pid(as->pid);
put_cred(as->cred);
kfree(as->urb->transfer_buffer);
kfree(as->urb->setup_packet);
usb_free_urb(as->urb);
Expand Down Expand Up @@ -393,9 +395,8 @@ static void async_completed(struct urb *urb)
struct dev_state *ps = as->ps;
struct siginfo sinfo;
struct pid *pid = NULL;
uid_t uid = 0;
uid_t euid = 0;
u32 secid = 0;
const struct cred *cred = NULL;
int signr;

spin_lock(&ps->lock);
Expand All @@ -408,8 +409,7 @@ static void async_completed(struct urb *urb)
sinfo.si_code = SI_ASYNCIO;
sinfo.si_addr = as->userurb;
pid = get_pid(as->pid);
uid = as->uid;
euid = as->euid;
cred = get_cred(as->cred);
secid = as->secid;
}
snoop(&urb->dev->dev, "urb complete\n");
Expand All @@ -423,9 +423,9 @@ static void async_completed(struct urb *urb)
spin_unlock(&ps->lock);

if (signr) {
kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid,
euid, secid);
kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid);
put_pid(pid);
put_cred(cred);
}

wake_up(&ps->wait);
Expand Down Expand Up @@ -672,7 +672,6 @@ static int usbdev_open(struct inode *inode, struct file *file)
{
struct usb_device *dev = NULL;
struct dev_state *ps;
const struct cred *cred = current_cred();
int ret;

ret = -ENOMEM;
Expand Down Expand Up @@ -722,8 +721,7 @@ static int usbdev_open(struct inode *inode, struct file *file)
init_waitqueue_head(&ps->wait);
ps->discsignr = 0;
ps->disc_pid = get_pid(task_pid(current));
ps->disc_uid = cred->uid;
ps->disc_euid = cred->euid;
ps->cred = get_current_cred();
ps->disccontext = NULL;
ps->ifclaimed = 0;
security_task_getsecid(current, &ps->secid);
Expand Down Expand Up @@ -765,6 +763,7 @@ static int usbdev_release(struct inode *inode, struct file *file)
usb_unlock_device(dev);
usb_put_dev(dev);
put_pid(ps->disc_pid);
put_cred(ps->cred);

as = async_getcompleted(ps);
while (as) {
Expand Down Expand Up @@ -1065,7 +1064,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
struct usb_host_endpoint *ep;
struct async *as;
struct usb_ctrlrequest *dr = NULL;
const struct cred *cred = current_cred();
unsigned int u, totlen, isofrmlen;
int ret, ifnum = -1;
int is_in;
Expand Down Expand Up @@ -1279,8 +1277,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb,
as->signr = uurb->signr;
as->ifnum = ifnum;
as->pid = get_pid(task_pid(current));
as->uid = cred->uid;
as->euid = cred->euid;
as->cred = get_current_cred();
security_task_getsecid(current, &as->secid);
if (!is_in && uurb->buffer_length > 0) {
if (copy_from_user(as->urb->transfer_buffer, uurb->buffer,
Expand Down Expand Up @@ -1998,9 +1995,8 @@ static void usbdev_remove(struct usb_device *udev)
sinfo.si_errno = EPIPE;
sinfo.si_code = SI_ASYNCIO;
sinfo.si_addr = ps->disccontext;
kill_pid_info_as_uid(ps->discsignr, &sinfo,
ps->disc_pid, ps->disc_uid,
ps->disc_euid, ps->secid);
kill_pid_info_as_cred(ps->discsignr, &sinfo,
ps->disc_pid, ps->cred, ps->secid);
}
}
}
Expand Down
3 changes: 2 additions & 1 deletion include/linux/sched.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2166,7 +2166,8 @@ extern int force_sigsegv(int, struct task_struct *);
extern int force_sig_info(int, struct siginfo *, struct task_struct *);
extern int __kill_pgrp_info(int sig, struct siginfo *info, struct pid *pgrp);
extern int kill_pid_info(int sig, struct siginfo *info, struct pid *pid);
extern int kill_pid_info_as_uid(int, struct siginfo *, struct pid *, uid_t, uid_t, u32);
extern int kill_pid_info_as_cred(int, struct siginfo *, struct pid *,
const struct cred *, u32);
extern int kill_pgrp(struct pid *pid, int sig, int priv);
extern int kill_pid(struct pid *pid, int sig, int priv);
extern int kill_proc_info(int, struct siginfo *, pid_t);
Expand Down
24 changes: 16 additions & 8 deletions kernel/signal.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1344,13 +1344,24 @@ int kill_proc_info(int sig, struct siginfo *info, pid_t pid)
return error;
}

static int kill_as_cred_perm(const struct cred *cred,
struct task_struct *target)
{
const struct cred *pcred = __task_cred(target);
if (cred->user_ns != pcred->user_ns)
return 0;
if (cred->euid != pcred->suid && cred->euid != pcred->uid &&
cred->uid != pcred->suid && cred->uid != pcred->uid)
return 0;
return 1;
}

/* like kill_pid_info(), but doesn't use uid/euid of "current" */
int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
uid_t uid, uid_t euid, u32 secid)
int kill_pid_info_as_cred(int sig, struct siginfo *info, struct pid *pid,
const struct cred *cred, u32 secid)
{
int ret = -EINVAL;
struct task_struct *p;
const struct cred *pcred;
unsigned long flags;

if (!valid_signal(sig))
Expand All @@ -1362,10 +1373,7 @@ int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
ret = -ESRCH;
goto out_unlock;
}
pcred = __task_cred(p);
if (si_fromuser(info) &&
euid != pcred->suid && euid != pcred->uid &&
uid != pcred->suid && uid != pcred->uid) {
if (si_fromuser(info) && !kill_as_cred_perm(cred, p)) {
ret = -EPERM;
goto out_unlock;
}
Expand All @@ -1384,7 +1392,7 @@ int kill_pid_info_as_uid(int sig, struct siginfo *info, struct pid *pid,
rcu_read_unlock();
return ret;
}
EXPORT_SYMBOL_GPL(kill_pid_info_as_uid);
EXPORT_SYMBOL_GPL(kill_pid_info_as_cred);

/*
* kill_something_info() interprets pid in interesting ways just like kill(2).
Expand Down

0 comments on commit d178bc3

Please sign in to comment.