[19/39] ovl: add ovl_mmap()

Commit Message

Miklos Szeredi May 29, 2018, 2:43 p.m. UTC

Implement stacked mmap.

Signed-off-by: Miklos Szeredi <[e-mail]>
---
 fs/overlayfs/file.c | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

Comments

Al Viro June 10, 2018, 5:24 a.m. UTC | #1

On Tue, May 29, 2018 at 04:43:19PM +0200, Miklos Szeredi wrote:
> Implement stacked mmap.
> 
> Signed-off-by: Miklos Szeredi <[e-mail]>
> ---
>  fs/overlayfs/file.c | 28 ++++++++++++++++++++++++++++
>  1 file changed, 28 insertions(+)
> 
> diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
> index 7b47dce4b072..4057bbf2e141 100644
> --- a/fs/overlayfs/file.c
> +++ b/fs/overlayfs/file.c
> @@ -255,6 +255,33 @@ static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync)
>  	return ret;
>  }
>  
> +static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
> +{
> +	struct fd real;
> +	const struct cred *old_cred;
> +	int ret;
> +
> +	ret = ovl_real_fdget(file, &real);
> +	if (ret)
> +		return ret;
> +
> +	/* transfer ref: */
> +	fput(vma->vm_file);
> +	vma->vm_file = get_file(real.file);
> +	fdput(real);
> +
> +	if (!vma->vm_file->f_op->mmap)
> +		return -ENODEV;

That's broken.  ->mmap() failure will fput(file), not fput(vma->vm_file).
What's more, _here_ your "corner case" is a huge DoS - open file r/o,
then have somebody else trigger copyup, then do tons of MAP_PRIVATE
mmaps on the r/o descriptor.  *EACH* *OF* *THEM* will open a separate
struct file and stash into into new vmas.

NAK with extreme prejudice, sensu PTerry...

Patch

diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
index 7b47dce4b072..4057bbf2e141 100644
--- a/fs/overlayfs/file.c
+++ b/fs/overlayfs/file.c
@@ -255,6 +255,33 @@  static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync)
 	return ret;
 }
 
+static int ovl_mmap(struct file *file, struct vm_area_struct *vma)
+{
+	struct fd real;
+	const struct cred *old_cred;
+	int ret;
+
+	ret = ovl_real_fdget(file, &real);
+	if (ret)
+		return ret;
+
+	/* transfer ref: */
+	fput(vma->vm_file);
+	vma->vm_file = get_file(real.file);
+	fdput(real);
+
+	if (!vma->vm_file->f_op->mmap)
+		return -ENODEV;
+
+	old_cred = ovl_override_creds(file_inode(file)->i_sb);
+	ret = call_mmap(vma->vm_file, vma);
+	revert_creds(old_cred);
+
+	ovl_file_accessed(file);
+
+	return ret;
+}
+
 const struct file_operations ovl_file_operations = {
 	.open		= ovl_open,
 	.release	= ovl_release,
@@ -262,4 +289,5 @@  const struct file_operations ovl_file_operations = {
 	.read_iter	= ovl_read_iter,
 	.write_iter	= ovl_write_iter,
 	.fsync		= ovl_fsync,
+	.mmap		= ovl_mmap,
 };