The dma-buf pseudo-filesystem should never have executable mappings nor
device nodes. Set SB_I_NOEXEC and SB_I_NODEV on the superblock to enforce
this at the filesystem level, similar to secretmem, commit 98f99394a104
("secretmem: use SB_I_NOEXEC").Fix the syzbot-reported warning from the exec code to enforce this requirement: > WARNING: CPU: 1 PID: 6000 at fs/exec.c:119 path_noexec+0x1af/0x200 > fs/exec.c:118 > Modules linked in: > CPU: 1 UID: 0 PID: 6000 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) > RIP: 0010:path_noexec+0x1af/0x200 fs/exec.c:118 > Call Trace: > <TASK> > do_mmap+0xa43/0x10d0 mm/mmap.c:469 > vm_mmap_pgoff+0x2a6/0x4d0 mm/util.c:580 > ksys_mmap_pgoff+0x51f/0x760 mm/mmap.c:604 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f Reported-by: [email protected] Closes: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Kees Cook <[email protected]> --- Cc: Christian Brauner <[email protected]> Cc: Sumit Semwal <[email protected]> Cc: "Christian König" <[email protected]> Cc: [email protected] Cc: <[email protected]> Cc: <[email protected]> Cc: <[email protected]> --- drivers/dma-buf/dma-buf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 2bcf9ceca997..6e2ab1a4560d 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -189,6 +189,8 @@ static int dma_buf_fs_init_context(struct fs_context *fc) { struct pseudo_fs_context *ctx; + fc->s_iflags |= SB_I_NOEXEC; + fc->s_iflags |= SB_I_NODEV; ctx = init_pseudo(fc, DMA_BUF_MAGIC); if (!ctx) return -ENOMEM; -- 2.34.1
