[kernel/f18] CVE-2013-1767 tmpfs: fix use-after-free of mempolicy obj (rhbz 915592, 915716)

[Josh Boyer]

commit f23e92fc888d1346c2714febe3b92dfdcd862973
Author: Josh Boyer <jwboyer at redhat.com>
Date:   Tue Feb 26 09:08:13 2013 -0500

    CVE-2013-1767 tmpfs: fix use-after-free of mempolicy obj (rhbz 915592,915716)

 kernel.spec                                        |    7 ++
 tmpfs-fix-use-after-free-of-mempolicy-object.patch |  107 ++++++++++++++++++++
 2 files changed, 114 insertions(+), 0 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index 4410b1e..a85160b 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -814,6 +814,9 @@ Patch22261: 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
 #rhbz 914737
 Patch22262: x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
 
+#CVE-2013-1767 rhbz 915592,915716
+Patch22263: tmpfs-fix-use-after-free-of-mempolicy-object.patch
+
 Patch23000: silence-brcmsmac-warning.patch
 
 #rhbz 812111
@@ -1577,6 +1580,9 @@ ApplyPatch 0001-kmsg-Honor-dmesg_restrict-sysctl-on-dev-kmsg.patch
 #rhbz 914737
 ApplyPatch x86-mm-Fix-vmalloc_fault-oops-during-lazy-MMU-updates.patch
 
+#CVE-2013-1767 rhbz 915592,915716
+ApplyPatch tmpfs-fix-use-after-free-of-mempolicy-object.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2441,6 +2447,7 @@ fi
 #                 ||     ||
 %changelog
 * Tue Feb 26 2013 Josh Boyer <jwboyer at redhat.com>
+- CVE-2013-1767 tmpfs: fix use-after-free of mempolicy obj (rhbz 915592,915716)
 - Fix vmalloc_fault oops during lazy MMU (rhbz 914737)
 
 * Mon Feb 25 2013 Josh Boyer <jwboyer at redhat.com>
diff --git a/tmpfs-fix-use-after-free-of-mempolicy-object.patch b/tmpfs-fix-use-after-free-of-mempolicy-object.patch
new file mode 100644
index 0000000..56dbf8e
--- /dev/null
+++ b/tmpfs-fix-use-after-free-of-mempolicy-object.patch
@@ -0,0 +1,107 @@
+From 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 Mon Sep 17 00:00:00 2001
+From: Greg Thelen <gthelen at google.com>
+Date: Fri, 22 Feb 2013 16:36:01 -0800
+Subject: [PATCH] tmpfs: fix use-after-free of mempolicy object
+
+The tmpfs remount logic preserves filesystem mempolicy if the mpol=M
+option is not specified in the remount request.  A new policy can be
+specified if mpol=M is given.
+
+Before this patch remounting an mpol bound tmpfs without specifying
+mpol= mount option in the remount request would set the filesystem's
+mempolicy object to a freed mempolicy object.
+
+To reproduce the problem boot a DEBUG_PAGEALLOC kernel and run:
+    # mkdir /tmp/x
+
+    # mount -t tmpfs -o size=100M,mpol=interleave nodev /tmp/x
+
+    # grep /tmp/x /proc/mounts
+    nodev /tmp/x tmpfs rw,relatime,size=102400k,mpol=interleave:0-3 0 0
+
+    # mount -o remount,size=200M nodev /tmp/x
+
+    # grep /tmp/x /proc/mounts
+    nodev /tmp/x tmpfs rw,relatime,size=204800k,mpol=??? 0 0
+        # note ? garbage in mpol=... output above
+
+    # dd if=/dev/zero of=/tmp/x/f count=1
+        # panic here
+
+Panic:
+    BUG: unable to handle kernel NULL pointer dereference at           (null)
+    IP: [<          (null)>]           (null)
+    [...]
+    Oops: 0010 [#1] SMP DEBUG_PAGEALLOC
+    Call Trace:
+      mpol_shared_policy_init+0xa5/0x160
+      shmem_get_inode+0x209/0x270
+      shmem_mknod+0x3e/0xf0
+      shmem_create+0x18/0x20
+      vfs_create+0xb5/0x130
+      do_last+0x9a1/0xea0
+      path_openat+0xb3/0x4d0
+      do_filp_open+0x42/0xa0
+      do_sys_open+0xfe/0x1e0
+      compat_sys_open+0x1b/0x20
+      cstar_dispatch+0x7/0x1f
+
+Non-debug kernels will not crash immediately because referencing the
+dangling mpol will not cause a fault.  Instead the filesystem will
+reference a freed mempolicy object, which will cause unpredictable
+behavior.
+
+The problem boils down to a dropped mpol reference below if
+shmem_parse_options() does not allocate a new mpol:
+
+    config = *sbinfo
+    shmem_parse_options(data, &config, true)
+    mpol_put(sbinfo->mpol)
+    sbinfo->mpol = config.mpol  /* BUG: saves unreferenced mpol */
+
+This patch avoids the crash by not releasing the mempolicy if
+shmem_parse_options() doesn't create a new mpol.
+
+How far back does this issue go? I see it in both 2.6.36 and 3.3.  I did
+not look back further.
+
+Signed-off-by: Greg Thelen <gthelen at google.com>
+Acked-by: Hugh Dickins <hughd at google.com>
+Cc: <stable at vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+---
+ mm/shmem.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 7162c58..5e2ff59 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2486,6 +2486,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
+ 	unsigned long inodes;
+ 	int error = -EINVAL;
+ 
++	config.mpol = NULL;
+ 	if (shmem_parse_options(data, &config, true))
+ 		return error;
+ 
+@@ -2510,8 +2511,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
+ 	sbinfo->max_inodes  = config.max_inodes;
+ 	sbinfo->free_inodes = config.max_inodes - inodes;
+ 
+-	mpol_put(sbinfo->mpol);
+-	sbinfo->mpol        = config.mpol;	/* transfers initial ref */
++	/*
++	 * Preserve previous mempolicy unless mpol remount option was specified.
++	 */
++	if (config.mpol) {
++		mpol_put(sbinfo->mpol);
++		sbinfo->mpol = config.mpol;	/* transfers initial ref */
++	}
+ out:
+ 	spin_unlock(&sbinfo->stat_lock);
+ 	return error;
+-- 
+1.8.1.2
+