Commit b537900f authored by Daniel Colascione's avatar Daniel Colascione Committed by Paul Moore
Browse files

userfaultfd: use secure anon inodes for userfaultfd 



This change gives userfaultfd file descriptors a real security
context, allowing policy to act on them.

Signed-off-by: default avatarDaniel Colascione <dancol@google.com>
[LG: Remove owner inode from userfaultfd_ctx]
[LG: Use anon_inode_getfd_secure() in userfaultfd syscall]
[LG: Use inode of file in userfaultfd_read() in resolve_userfault_fork()]
Signed-off-by: default avatarLokesh Gidra <lokeshgidra@google.com>
Reviewed-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 29cd6591

fs/userfaultfd.c

+10 −9
Original line number Diff line number Diff line
@@ -979,14 +979,14 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait) 


static const struct file_operations userfaultfd_fops;



static int resolve_userfault_fork(struct userfaultfd_ctx *ctx,

				  struct userfaultfd_ctx *new,

static int resolve_userfault_fork(struct userfaultfd_ctx *new,

				  struct inode *inode,

				  struct uffd_msg *msg)

{

	int fd;



	fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, new,

			      O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS));

	fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new,

			O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode);

	if (fd < 0)

		return fd;
@@ -996,7 +996,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *ctx, 
}



static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,

				    struct uffd_msg *msg)

				    struct uffd_msg *msg, struct inode *inode)

{

	ssize_t ret;

	DECLARE_WAITQUEUE(wait, current);
@@ -1107,7 +1107,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, 
	spin_unlock_irq(&ctx->fd_wqh.lock);



	if (!ret && msg->event == UFFD_EVENT_FORK) {

		ret = resolve_userfault_fork(ctx, fork_nctx, msg);

		ret = resolve_userfault_fork(fork_nctx, inode, msg);

		spin_lock_irq(&ctx->event_wqh.lock);

		if (!list_empty(&fork_event)) {

			/*
@@ -1167,6 +1167,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf, 
	ssize_t _ret, ret = 0;

	struct uffd_msg msg;

	int no_wait = file->f_flags & O_NONBLOCK;

	struct inode *inode = file_inode(file);



	if (ctx->state == UFFD_STATE_WAIT_API)

		return -EINVAL;
@@ -1174,7 +1175,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf, 
	for (;;) {

		if (count < sizeof(msg))

			return ret ? ret : -EINVAL;

		_ret = userfaultfd_ctx_read(ctx, no_wait, &msg);

		_ret = userfaultfd_ctx_read(ctx, no_wait, &msg, inode);

		if (_ret < 0)

			return ret ? ret : _ret;

		if (copy_to_user((__u64 __user *) buf, &msg, sizeof(msg)))
@@ -1999,8 +2000,8 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) 
	/* prevent the mm struct to be freed */

	mmgrab(ctx->mm);



	fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, ctx,

			      O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));

	fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx,

			O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);

	if (fd < 0) {

		mmdrop(ctx->mm);

		kmem_cache_free(userfaultfd_ctx_cachep, ctx);