diff options
author | Serge Hallyn <serge.hallyn@canonical.com> | 2011-09-26 11:45:18 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@suse.de> | 2011-09-29 16:13:08 -0400 |
commit | d178bc3a708f39cbfefc3fab37032d3f2511b4ec (patch) | |
tree | af492e92e140f1f6abad5a377a269ef7335824de /drivers/usb/core | |
parent | edb2b255a0bebac5aeb17c7613aeb76ba4e6c63c (diff) |
user namespace: usb: make usb urbs user namespace aware (v2)
Add to the dev_state and alloc_async structures the user namespace
corresponding to the uid and euid. Pass these to kill_pid_info_as_uid(),
which can then implement a proper, user-namespace-aware uid check.
Changelog:
Sep 20: Per Oleg's suggestion: Instead of caching and passing user namespace,
uid, and euid each separately, pass a struct cred.
Sep 26: Address Alan Stern's comments: don't define a struct cred at
usbdev_open(), and take and put a cred at async_completed() to
ensure it lasts for the duration of kill_pid_info_as_cred().
Signed-off-by: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers/usb/core')
-rw-r--r-- | drivers/usb/core/devio.c | 30 |
1 files changed, 13 insertions, 17 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 0ca54e22d31..e3beaf229ee 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c | |||
@@ -46,6 +46,7 @@ | |||
46 | #include <linux/cdev.h> | 46 | #include <linux/cdev.h> |
47 | #include <linux/notifier.h> | 47 | #include <linux/notifier.h> |
48 | #include <linux/security.h> | 48 | #include <linux/security.h> |
49 | #include <linux/user_namespace.h> | ||
49 | #include <asm/uaccess.h> | 50 | #include <asm/uaccess.h> |
50 | #include <asm/byteorder.h> | 51 | #include <asm/byteorder.h> |
51 | #include <linux/moduleparam.h> | 52 | #include <linux/moduleparam.h> |
@@ -68,7 +69,7 @@ struct dev_state { | |||
68 | wait_queue_head_t wait; /* wake up if a request completed */ | 69 | wait_queue_head_t wait; /* wake up if a request completed */ |
69 | unsigned int discsignr; | 70 | unsigned int discsignr; |
70 | struct pid *disc_pid; | 71 | struct pid *disc_pid; |
71 | uid_t disc_uid, disc_euid; | 72 | const struct cred *cred; |
72 | void __user *disccontext; | 73 | void __user *disccontext; |
73 | unsigned long ifclaimed; | 74 | unsigned long ifclaimed; |
74 | u32 secid; | 75 | u32 secid; |
@@ -79,7 +80,7 @@ struct async { | |||
79 | struct list_head asynclist; | 80 | struct list_head asynclist; |
80 | struct dev_state *ps; | 81 | struct dev_state *ps; |
81 | struct pid *pid; | 82 | struct pid *pid; |
82 | uid_t uid, euid; | 83 | const struct cred *cred; |
83 | unsigned int signr; | 84 | unsigned int signr; |
84 | unsigned int ifnum; | 85 | unsigned int ifnum; |
85 | void __user *userbuffer; | 86 | void __user *userbuffer; |
@@ -248,6 +249,7 @@ static struct async *alloc_async(unsigned int numisoframes) | |||
248 | static void free_async(struct async *as) | 249 | static void free_async(struct async *as) |
249 | { | 250 | { |
250 | put_pid(as->pid); | 251 | put_pid(as->pid); |
252 | put_cred(as->cred); | ||
251 | kfree(as->urb->transfer_buffer); | 253 | kfree(as->urb->transfer_buffer); |
252 | kfree(as->urb->setup_packet); | 254 | kfree(as->urb->setup_packet); |
253 | usb_free_urb(as->urb); | 255 | usb_free_urb(as->urb); |
@@ -393,9 +395,8 @@ static void async_completed(struct urb *urb) | |||
393 | struct dev_state *ps = as->ps; | 395 | struct dev_state *ps = as->ps; |
394 | struct siginfo sinfo; | 396 | struct siginfo sinfo; |
395 | struct pid *pid = NULL; | 397 | struct pid *pid = NULL; |
396 | uid_t uid = 0; | ||
397 | uid_t euid = 0; | ||
398 | u32 secid = 0; | 398 | u32 secid = 0; |
399 | const struct cred *cred = NULL; | ||
399 | int signr; | 400 | int signr; |
400 | 401 | ||
401 | spin_lock(&ps->lock); | 402 | spin_lock(&ps->lock); |
@@ -408,8 +409,7 @@ static void async_completed(struct urb *urb) | |||
408 | sinfo.si_code = SI_ASYNCIO; | 409 | sinfo.si_code = SI_ASYNCIO; |
409 | sinfo.si_addr = as->userurb; | 410 | sinfo.si_addr = as->userurb; |
410 | pid = get_pid(as->pid); | 411 | pid = get_pid(as->pid); |
411 | uid = as->uid; | 412 | cred = get_cred(as->cred); |
412 | euid = as->euid; | ||
413 | secid = as->secid; | 413 | secid = as->secid; |
414 | } | 414 | } |
415 | snoop(&urb->dev->dev, "urb complete\n"); | 415 | snoop(&urb->dev->dev, "urb complete\n"); |
@@ -423,9 +423,9 @@ static void async_completed(struct urb *urb) | |||
423 | spin_unlock(&ps->lock); | 423 | spin_unlock(&ps->lock); |
424 | 424 | ||
425 | if (signr) { | 425 | if (signr) { |
426 | kill_pid_info_as_uid(sinfo.si_signo, &sinfo, pid, uid, | 426 | kill_pid_info_as_cred(sinfo.si_signo, &sinfo, pid, cred, secid); |
427 | euid, secid); | ||
428 | put_pid(pid); | 427 | put_pid(pid); |
428 | put_cred(cred); | ||
429 | } | 429 | } |
430 | 430 | ||
431 | wake_up(&ps->wait); | 431 | wake_up(&ps->wait); |
@@ -672,7 +672,6 @@ static int usbdev_open(struct inode *inode, struct file *file) | |||
672 | { | 672 | { |
673 | struct usb_device *dev = NULL; | 673 | struct usb_device *dev = NULL; |
674 | struct dev_state *ps; | 674 | struct dev_state *ps; |
675 | const struct cred *cred = current_cred(); | ||
676 | int ret; | 675 | int ret; |
677 | 676 | ||
678 | ret = -ENOMEM; | 677 | ret = -ENOMEM; |
@@ -722,8 +721,7 @@ static int usbdev_open(struct inode *inode, struct file *file) | |||
722 | init_waitqueue_head(&ps->wait); | 721 | init_waitqueue_head(&ps->wait); |
723 | ps->discsignr = 0; | 722 | ps->discsignr = 0; |
724 | ps->disc_pid = get_pid(task_pid(current)); | 723 | ps->disc_pid = get_pid(task_pid(current)); |
725 | ps->disc_uid = cred->uid; | 724 | ps->cred = get_current_cred(); |
726 | ps->disc_euid = cred->euid; | ||
727 | ps->disccontext = NULL; | 725 | ps->disccontext = NULL; |
728 | ps->ifclaimed = 0; | 726 | ps->ifclaimed = 0; |
729 | security_task_getsecid(current, &ps->secid); | 727 | security_task_getsecid(current, &ps->secid); |
@@ -765,6 +763,7 @@ static int usbdev_release(struct inode *inode, struct file *file) | |||
765 | usb_unlock_device(dev); | 763 | usb_unlock_device(dev); |
766 | usb_put_dev(dev); | 764 | usb_put_dev(dev); |
767 | put_pid(ps->disc_pid); | 765 | put_pid(ps->disc_pid); |
766 | put_cred(ps->cred); | ||
768 | 767 | ||
769 | as = async_getcompleted(ps); | 768 | as = async_getcompleted(ps); |
770 | while (as) { | 769 | while (as) { |
@@ -1065,7 +1064,6 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb, | |||
1065 | struct usb_host_endpoint *ep; | 1064 | struct usb_host_endpoint *ep; |
1066 | struct async *as; | 1065 | struct async *as; |
1067 | struct usb_ctrlrequest *dr = NULL; | 1066 | struct usb_ctrlrequest *dr = NULL; |
1068 | const struct cred *cred = current_cred(); | ||
1069 | unsigned int u, totlen, isofrmlen; | 1067 | unsigned int u, totlen, isofrmlen; |
1070 | int ret, ifnum = -1; | 1068 | int ret, ifnum = -1; |
1071 | int is_in; | 1069 | int is_in; |
@@ -1279,8 +1277,7 @@ static int proc_do_submiturb(struct dev_state *ps, struct usbdevfs_urb *uurb, | |||
1279 | as->signr = uurb->signr; | 1277 | as->signr = uurb->signr; |
1280 | as->ifnum = ifnum; | 1278 | as->ifnum = ifnum; |
1281 | as->pid = get_pid(task_pid(current)); | 1279 | as->pid = get_pid(task_pid(current)); |
1282 | as->uid = cred->uid; | 1280 | as->cred = get_current_cred(); |
1283 | as->euid = cred->euid; | ||
1284 | security_task_getsecid(current, &as->secid); | 1281 | security_task_getsecid(current, &as->secid); |
1285 | if (!is_in && uurb->buffer_length > 0) { | 1282 | if (!is_in && uurb->buffer_length > 0) { |
1286 | if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, | 1283 | if (copy_from_user(as->urb->transfer_buffer, uurb->buffer, |
@@ -1998,9 +1995,8 @@ static void usbdev_remove(struct usb_device *udev) | |||
1998 | sinfo.si_errno = EPIPE; | 1995 | sinfo.si_errno = EPIPE; |
1999 | sinfo.si_code = SI_ASYNCIO; | 1996 | sinfo.si_code = SI_ASYNCIO; |
2000 | sinfo.si_addr = ps->disccontext; | 1997 | sinfo.si_addr = ps->disccontext; |
2001 | kill_pid_info_as_uid(ps->discsignr, &sinfo, | 1998 | kill_pid_info_as_cred(ps->discsignr, &sinfo, |
2002 | ps->disc_pid, ps->disc_uid, | 1999 | ps->disc_pid, ps->cred, ps->secid); |
2003 | ps->disc_euid, ps->secid); | ||
2004 | } | 2000 | } |
2005 | } | 2001 | } |
2006 | } | 2002 | } |