CVE-2018-1000028 - debugging fs/nfsd/auth.c

auth.c

int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
{
    struct group_info *rqgi;
    struct group_info *gi;
    struct cred *new;
    int i, j;
    int flags = nfsexp_flags(rqstp, exp);

    validate_process_creds();

    /* discard any old override before preparing the new set */
    revert_creds(get_cred(current_real_cred()));
    new = prepare_creds();
    if (!new)
        return -ENOMEM;

    new->fsuid = rqstp->rq_cred.cr_uid;
    new->fsgid = rqstp->rq_cred.cr_gid;
    printk(KERN_INFO "[RAMBO] new->fsuid = rqstp->rq_cred.cr_uid = %d\n", new->fsuid);
    printk(KERN_INFO "[RAMBO] new->fsgid = rqstp->rq_cred.cr_gid = %d\n", new->fsgid);

    rqgi = rqstp->rq_cred.cr_group_info;

    if (flags & NFSEXP_ALLSQUASH) {
        printk(KERN_INFO "[RAMBO] in flags & NFSEXP_ALLSQUASH\n");
        new->fsuid = exp->ex_anon_uid;
        new->fsgid = exp->ex_anon_gid;
        gi = groups_alloc(0);
        if (!gi)
            goto oom;
    } else if (flags & NFSEXP_ROOTSQUASH) {
        printk(KERN_INFO "[RAMBO] in flags & NFSEXP_ROOTSQUASH\n");
        if (uid_eq(new->fsuid, GLOBAL_ROOT_UID)) {
            printk(KERN_INFO "[RAMBO] uid_eq(new->fsuid, GLOBAL_ROOT_UID)\n");
            new->fsuid = exp->ex_anon_uid;
        }
        if (gid_eq(new->fsgid, GLOBAL_ROOT_GID)) {
            printk(KERN_INFO "[RAMBO] gid_eq(new->fsgid, GLOBAL_ROOT_GID)\n");
            new->fsgid = exp->ex_anon_gid;
        }

        gi = groups_alloc(rqgi->ngroups);
        if (!gi)
            goto oom;

        printk(KERN_INFO "[RAMBO] rqgi->ngroups: %d\n", rqgi->ngroups);
        for (i = 0; i < rqgi->ngroups; i++) {
            printk(KERN_INFO "[RAMBO] [%d/%d]\n", i, rqgi->ngroups);
            if (gid_eq(GLOBAL_ROOT_GID, rqgi->gid[i])) {
                gi->gid[i] = exp->ex_anon_gid;
                printk(KERN_INFO "[RAMBO] gi->gid[i] = exp->ex_anon_gid = %d\n", exp->ex_anon_gid);
            }
            else {
                gi->gid[i] = rqgi->gid[i];
                printk(KERN_INFO "[RAMBO] gi->gid[i] = rqgi->gid[i] = %d\n", rqgi->gid[i]);
            }
            printk(KERN_INFO "[RAMBO] before groups_sort:\n");
            for (j = 0; j < rqgi->ngroups; j++) {
                printk(KERN_INFO "%d ", gi->gid[j]);
            }
            printk(KERN_INFO "\n");

            /* Each thread allocates its own gi, no race */
            groups_sort(gi);
            printk(KERN_INFO "[RAMBO] after groups_sort:\n");
            for (j = 0; j < rqgi->ngroups; j++) {
                printk(KERN_INFO "%d ", gi->gid[j]);
            }
            printk(KERN_INFO "\n");
        }
    } else {
        printk(KERN_INFO "[RAMBO] WHY IN ELSE???\n");
        gi = get_group_info(rqgi);
    }

    if (uid_eq(new->fsuid, INVALID_UID))
        new->fsuid = exp->ex_anon_uid;
    if (gid_eq(new->fsgid, INVALID_GID)) {
        printk(KERN_INFO "[RAMBO] gid_eq(new->fsgid, INVALID_GID)\n");
        new->fsgid = exp->ex_anon_gid;
    }

    set_groups(new, gi);
    put_group_info(gi);

    if (!uid_eq(new->fsuid, GLOBAL_ROOT_UID))
        new->cap_effective = cap_drop_nfsd_set(new->cap_effective);
    else
        new->cap_effective = cap_raise_nfsd_set(new->cap_effective,
                            new->cap_permitted);
    validate_process_creds();
    put_cred(override_creds(new));
    put_cred(new);
    validate_process_creds();
    return 0;

oom:
    abort_creds(new);
    return -ENOMEM;
}