Commit ee125951 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jan Kara
Browse files

fanotify: Fix stale file descriptor in copy_event_to_user() 

This code calls fd_install() which gives the userspace access to the fd.
Then if copy_info_records_to_user() fails it calls put_unused_fd(fd) but
that will not release it and leads to a stale entry in the file
descriptor table.

Generally you can't trust the fd after a call to fd_install().  The fix
is to delay the fd_install() until everything else has succeeded.

Fortunately it requires CAP_SYS_ADMIN to reach this code so the security
impact is less.

Fixes: f644bc44 ("fanotify: fix copy_event_to_user() fid error clean up")
Link: https://lore.kernel.org/r/20220128195656.GA26981@kili


Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarMathias Krause <minipli@grsecurity.net>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 26291c54

fs/notify/fanotify/fanotify_user.c

+3 −3
Original line number Diff line number Diff line
@@ -701,9 +701,6 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, 
	if (fanotify_is_perm_event(event->mask))

		FANOTIFY_PERM(event)->fd = fd;



	if (f)

		fd_install(fd, f);



	if (info_mode) {

		ret = copy_info_records_to_user(event, info, info_mode, pidfd,

						buf, count);
@@ -711,6 +708,9 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, 
			goto out_close_fd;

	}



	if (f)

		fd_install(fd, f);



	return metadata.event_len;



out_close_fd: