filelock: Remove locks reliably when fcntl/close race is detected

When fcntl_setlk() races with close(), it removes the created lock with
do_lock_file_wait().
However, LSMs can allow the first do_lock_file_wait() that created the lock
while denying the second do_lock_file_wait() that tries to remove the lock.
In theory (but AFAIK not in practice), posix_lock_file() could also fail to
remove a lock due to GFP_KERNEL allocation failure (when splitting a range
in the middle).

After the bug has been triggered, use-after-free reads will occur in
lock_get_status() when userspace reads /proc/locks. This can likely be used
to read arbitrary kernel memory, but can't corrupt kernel memory.
This only affects systems with SELinux / Smack / AppArmor / BPF-LSM in
enforcing mode and only works from some security contexts.

Fix it by calling locks_remove_posix() instead, which is designed to
reliably get rid of POSIX locks associated with the given file and
files_struct and is also used by filp_flush().

Fixes: c293621bbf67 ("[PATCH] stale POSIX lock handling")
Cc: [email protected]
Link: https://bugs.chromium.org/p/project-zero/issues/detail?id=2563
Signed-off-by: Jann Horn <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Jeff Layton <[email protected]>
Signed-off-by: Christian Brauner <[email protected]>

diff --git a/fs/locks.c b/fs/locks.c
index 90c8746874dedbbb71e14b8269bbbcd216fd1bf7..c360d1992d21f9ce12053cc48ede43333e3f66fa 100644 (file)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -2448,8 +2448,9 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
        error = do_lock_file_wait(filp, cmd, file_lock);
 
        /*
-        * Attempt to detect a close/fcntl race and recover by releasing the
-        * lock that was just acquired. There is no need to do that when we're
+        * Detect close/fcntl races and recover by zapping all POSIX locks
+        * associated with this file and our files_struct, just like on
+        * filp_flush(). There is no need to do that when we're
         * unlocking though, or for OFD locks.
         */
        if (!error && file_lock->c.flc_type != F_UNLCK &&
@@ -2464,9 +2465,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
                f = files_lookup_fd_locked(files, fd);
                spin_unlock(&files->file_lock);
                if (f != filp) {
-                       file_lock->c.flc_type = F_UNLCK;
-                       error = do_lock_file_wait(filp, cmd, file_lock);
-                       WARN_ON_ONCE(error);
+                       locks_remove_posix(filp, files);
                        error = -EBADF;
                }
        }