From owner-dev-commits-src-main@freebsd.org Fri Feb 26 04:12:34 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 31838553E7B; Fri, 26 Feb 2021 04:12:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Dmx820zYmz4jhw; Fri, 26 Feb 2021 04:12:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 151FD242D4; Fri, 26 Feb 2021 04:12:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 11Q4CXBK063118; Fri, 26 Feb 2021 04:12:33 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 11Q4CX5T063117; Fri, 26 Feb 2021 04:12:33 GMT (envelope-from git) Date: Fri, 26 Feb 2021 04:12:33 GMT Message-Id: <202102260412.11Q4CX5T063117@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Jamie Gritton Subject: git: 589e4c1df4a6 - main - jail: Add safety around prison_deref() flags. MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jamie X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 589e4c1df4a6e4b1368f26fc7fef704a2e5cb42c Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 26 Feb 2021 04:12:34 -0000 The branch main has been updated by jamie: URL: https://cgit.FreeBSD.org/src/commit/?id=589e4c1df4a6e4b1368f26fc7fef704a2e5cb42c commit 589e4c1df4a6e4b1368f26fc7fef704a2e5cb42c Author: Jamie Gritton AuthorDate: 2021-02-26 04:10:42 +0000 Commit: Jamie Gritton CommitDate: 2021-02-26 04:10:42 +0000 jail: Add safety around prison_deref() flags. do_jail_attach() now only uses the PD_XXX flags that refer to lock status, so make sure that something else like PD_KILL doesn't slip through. Add a KASSERT() in prison_deref() to catch any further PD_KILL misuse. --- sys/kern/kern_jail.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index c8dcf928dfaa..b5c8f6ebf9be 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -161,6 +161,8 @@ static void prison_racct_detach(struct prison *pr); #define PD_LOCKED 0x10 /* pr_mtx is held */ #define PD_LIST_SLOCKED 0x20 /* allprison_lock is held shared */ #define PD_LIST_XLOCKED 0x40 /* allprison_lock is held exclusive */ +#define PD_OP_FLAGS 0x07 /* Operation flags */ +#define PD_LOCK_FLAGS 0x70 /* Lock status flags */ /* * Parameter names corresponding to PR_* flag values. Size values are for kvm @@ -1836,7 +1838,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) /* Attach this process to the prison if requested. */ if (flags & JAIL_ATTACH) { error = do_jail_attach(td, pr, - prison_lock_xlock(pr, drflags & ~PD_KILL)); + prison_lock_xlock(pr, drflags & PD_LOCK_FLAGS)); drflags &= ~(PD_LOCKED | PD_LIST_XLOCKED); if (error) { vfs_opterror(opts, "attach failed"); @@ -2346,6 +2348,7 @@ do_jail_attach(struct thread *td, struct prison *pr, int drflags) mtx_assert(&pr->pr_mtx, MA_OWNED); sx_assert(&allprison_lock, SX_LOCKED); + drflags &= PD_LOCK_FLAGS; /* * XXX: Note that there is a slight race here if two threads * in the same privileged process attempt to attach to two @@ -2719,6 +2722,8 @@ prison_deref(struct prison *pr, int flags) for (;;) { if (flags & PD_KILL) { /* Kill the prison and its descendents. */ + KASSERT(pr != &prison0, + ("prison_deref trying to kill prison0")); if (!(flags & PD_DEREF)) { prison_hold(pr); flags |= PD_DEREF; @@ -2755,7 +2760,6 @@ prison_deref(struct prison *pr, int flags) } } if (flags & PD_KILL) { - flags &= ~PD_KILL; /* * Any remaining user references are probably processes * that need to be killed, either in this prison or its @@ -2763,6 +2767,8 @@ prison_deref(struct prison *pr, int flags) */ if (refcount_load(&pr->pr_uref) > 0) killpr = pr; + /* Make sure the parent prison doesn't get killed. */ + flags &= ~PD_KILL; } if (flags & PD_DEREF) { /* Drop a reference. */