Attachment 53881 Details for Bug 127916

[patch] usbdevio-1.patch

usbdevio-1.patch (text/plain), 7.63 KB, created by Olaf Hering on 2005-10-12 21:08:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Hering

Created: 2005-10-12 21:08:43 UTC

Size: 7.63 KB

patch

obsolete

>Return-Path: <git-commits-head-owner@vger.kernel.org>
>X-Original-To: olh@wotan.suse.de
>Received: from Relay1.suse.de (relay1.suse.de [IPv6:2001:780:101:0:211:25ff:fe4a:6dba])
>	by wotan.suse.de (Postfix) with ESMTP id 4A4DD421777
>	for <olh@wotan.suse.de>; Tue, 11 Oct 2005 03:59:30 +0200 (CEST)
>Received: by Relay1.suse.de (Postfix)
>	id 467432BF71; Tue, 11 Oct 2005 03:59:30 +0200 (CEST)
>Received: from Relay1.suse.de (localhost [127.0.0.1])
>	by Relay1.suse.de (Postfix) with ESMTP id 39FD62BF6F
>	for <olh@suse.de>; Tue, 11 Oct 2005 03:59:30 +0200 (CEST)
>Received: from Relay1.suse.de ([127.0.0.1])
> by Relay1.suse.de (Relay1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP
> id 31502-20 for <olh@suse.de>; Tue, 11 Oct 2005 03:59:29 +0200 (CEST)
>Received: from mx1.suse.de (ns1.suse.de [195.135.220.2])
>	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
>	(No client certificate requested)
>	by Relay1.suse.de (Postfix) with ESMTP id D5CB3298C7
>	for <olh@suse.de>; Tue, 11 Oct 2005 03:59:29 +0200 (CEST)
>Received: from vger.kernel.org (vger.kernel.org [209.132.176.167])
>	by mx1.suse.de (Postfix) with ESMTP id 6A53DE3B4
>	for <olh@suse.de>; Tue, 11 Oct 2005 03:59:29 +0200 (CEST)
>Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
>	id S1751350AbVJKB72 (ORCPT <rfc822;olh@suse.de>);
>	Mon, 10 Oct 2005 21:59:28 -0400
>Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1751351AbVJKB72
>	(ORCPT <rfc822;git-commits-head-outgoing>);
>	Mon, 10 Oct 2005 21:59:28 -0400
>Received: from hera.kernel.org ([140.211.167.34]:32648 "EHLO hera.kernel.org")
>	by vger.kernel.org with ESMTP id S1751350AbVJKB71 (ORCPT
>	<rfc822;git-commits-head@vger.kernel.org>);
>	Mon, 10 Oct 2005 21:59:27 -0400
>Received: from hera.kernel.org (localhost [127.0.0.1])
>	by hera.kernel.org (8.13.1/8.13.1) with ESMTP id j9B1xPQW025187
>	for <git-commits-head@vger.kernel.org>; Mon, 10 Oct 2005 18:59:25 -0700
>Received: (from dwmw2@localhost)
>	by hera.kernel.org (8.13.1/8.13.1/Submit) id j9B1xPPA025186
>	for git-commits-head@vger.kernel.org; Mon, 10 Oct 2005 18:59:25 -0700
>Date:	Mon, 10 Oct 2005 18:59:25 -0700
>Message-Id: <200510110159.j9B1xPPA025186@hera.kernel.org>
>From: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
>To: git-commits-head@vger.kernel.org
>Subject: [PATCH] Fix signal sending in usbdevio on async URB completion
>MIME-Version: 1.0
>Content-Type: text/plain; charset=UTF-8
>X-Git-Commit: 46113830a18847cff8da73005e57bc49c2f95a56
>X-Git-Parent: 094804c5a132f04c12dd4902ee15c64362e5c1af
>X-Virus-Status:	Clean
>Sender: git-commits-head-owner@vger.kernel.org
>Precedence: bulk
>X-Mailing-List:	git-commits-head@vger.kernel.org
>X-Virus-Scanned: by amavisd-new at Relay1.suse.de
>X-Spam-Status: No, hits=-1.0 tagged_above=-20.0 required=5.0 tests=BAYES_50,
> MY_LINUX
>X-Spam-Level: 
>X-my-mailinglist-tag: git-commits-head.vger.kernel.org
>
>tree 93946fc290d9481e7055217ff497583647d1e4d4
>parent 094804c5a132f04c12dd4902ee15c64362e5c1af
>author Harald Welte <laforge@gnumonks.org> Mon, 10 Oct 2005 19:44:29 +0200
>committer Linus Torvalds <torvalds@g5.osdl.org> Tue, 11 Oct 2005 06:16:33 -0700
>
>[PATCH] Fix signal sending in usbdevio on async URB completion
>
>If a process issues an URB from userspace and (starts to) terminate
>before the URB comes back, we run into the issue described above.  This
>is because the urb saves a pointer to "current" when it is posted to the
>device, but there's no guarantee that this pointer is still valid
>afterwards.
>
>In fact, there are three separate issues:
>
>1) the pointer to "current" can become invalid, since the task could be
>   completely gone when the URB completion comes back from the device.
>
>2) Even if the saved task pointer is still pointing to a valid task_struct,
>   task_struct->sighand could have gone meanwhile.
>
>3) Even if the process is perfectly fine, permissions may have changed,
>   and we can no longer send it a signal.
>
>So what we do instead, is to save the PID and uid's of the process, and
>introduce a new kill_proc_info_as_uid() function.
>
>Signed-off-by: Harald Welte <laforge@gnumonks.org>
>[ Fixed up types and added symbol exports ]
>Signed-off-by: Linus Torvalds <torvalds@osdl.org>
>
> drivers/usb/core/devio.c |   12 +++++++++---
> include/linux/sched.h    |    1 +
> kernel/signal.c          |   34 ++++++++++++++++++++++++++++++++++
> 3 files changed, 44 insertions(+), 3 deletions(-)
>
>diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
>--- a/drivers/usb/core/devio.c
>+++ b/drivers/usb/core/devio.c
>@@ -30,6 +30,8 @@
>  *  Revision history
>  *    22.12.1999   0.1   Initial release (split from proc_usb.c)
>  *    04.01.2000   0.2   Turned into its own filesystem
>+ *    30.09.2005   0.3   Fix user-triggerable oops in async URB delivery
>+ *    			 (CAN-2005-3055)
>  */
> 
> /*****************************************************************************/
>@@ -58,7 +60,8 @@ static struct class *usb_device_class;
> struct async {
> 	struct list_head asynclist;
> 	struct dev_state *ps;
>-	struct task_struct *task;
>+	pid_t pid;
>+	uid_t uid, euid;
> 	unsigned int signr;
> 	unsigned int ifnum;
> 	void __user *userbuffer;
>@@ -290,7 +293,8 @@ static void async_completed(struct urb *
> 		sinfo.si_errno = as->urb->status;
> 		sinfo.si_code = SI_ASYNCIO;
> 		sinfo.si_addr = as->userurb;
>-		send_sig_info(as->signr, &sinfo, as->task);
>+		kill_proc_info_as_uid(as->signr, &sinfo, as->pid, as->uid, 
>+				      as->euid);
> 	}
>         wake_up(&ps->wait);
> }
>@@ -988,7 +992,9 @@ static int proc_do_submiturb(struct dev_
> 		as->userbuffer = NULL;
> 	as->signr = uurb->signr;
> 	as->ifnum = ifnum;
>-	as->task = current;
>+	as->pid = current->pid;
>+	as->uid = current->uid;
>+	as->euid = current->euid;
> 	if (!(uurb->endpoint & USB_DIR_IN)) {
> 		if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, as->urb->transfer_buffer_length)) {
> 			free_async(as);
>diff --git a/include/linux/sched.h b/include/linux/sched.h
>--- a/include/linux/sched.h
>+++ b/include/linux/sched.h
>@@ -1018,6 +1018,7 @@ extern int force_sig_info(int, struct si
> extern int __kill_pg_info(int sig, struct siginfo *info, pid_t pgrp);
> extern int kill_pg_info(int, struct siginfo *, pid_t);
> extern int kill_proc_info(int, struct siginfo *, pid_t);
>+extern int kill_proc_info_as_uid(int, struct siginfo *, pid_t, uid_t, uid_t);
> extern void do_notify_parent(struct task_struct *, int);
> extern void force_sig(int, struct task_struct *);
> extern void force_sig_specific(int, struct task_struct *);
>diff --git a/kernel/signal.c b/kernel/signal.c
>--- a/kernel/signal.c
>+++ b/kernel/signal.c
>@@ -1193,6 +1193,40 @@ kill_proc_info(int sig, struct siginfo *
> 	return error;
> }
> 
>+/* like kill_proc_info(), but doesn't use uid/euid of "current" */
>+int kill_proc_info_as_uid(int sig, struct siginfo *info, pid_t pid,
>+		      uid_t uid, uid_t euid)
>+{
>+	int ret = -EINVAL;
>+	struct task_struct *p;
>+
>+	if (!valid_signal(sig))
>+		return ret;
>+
>+	read_lock(&tasklist_lock);
>+	p = find_task_by_pid(pid);
>+	if (!p) {
>+		ret = -ESRCH;
>+		goto out_unlock;
>+	}
>+	if ((!info || ((unsigned long)info != 1 &&
>+			(unsigned long)info != 2 && SI_FROMUSER(info)))
>+	    && (euid != p->suid) && (euid != p->uid)
>+	    && (uid != p->suid) && (uid != p->uid)) {
>+		ret = -EPERM;
>+		goto out_unlock;
>+	}
>+	if (sig && p->sighand) {
>+		unsigned long flags;
>+		spin_lock_irqsave(&p->sighand->siglock, flags);
>+		ret = __group_send_sig_info(sig, info, p);
>+		spin_unlock_irqrestore(&p->sighand->siglock, flags);
>+	}
>+out_unlock:
>+	read_unlock(&tasklist_lock);
>+	return ret;
>+}
>+EXPORT_SYMBOL_GPL(kill_proc_info_as_uid);
> 
> /*
>  * kill_something_info() interprets pid in interesting ways just like kill(2).
>-
>To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Actions: View | Diff

Attachments on bug 127916: 53881 | 53882