Re: fs: use-after-free in path_lookupat

From	Dmitry Vyukov <dvyukov@google.com>
Newsgroups	linux.kernel
Subject	Re: fs: use-after-free in path_lookupat
Date	2017-03-05 17:20 +0100
Message-ID	<thH34-2Ka-9@gated-at.bofh.it> (permalink)
References	(2 earlier) <thCmJ-7RH-1@gated-at.bofh.it> <thCwq-7VQ-7@gated-at.bofh.it> <thCwq-7VQ-5@gated-at.bofh.it> <thCPM-87W-11@gated-at.bofh.it> <thH34-2Ka-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote:
>
>> I am pretty sure it is that one.
>> I don't think I ever used name_to_handle_at syscall in my life and I
>> definitely didn't make it lookup a memfd :)
>
> So what does it normally return?  On the runs where we do not hit that
> use-after-free, that is.
>
> What gets triggered there is nd->path.dentry pointing to already freed
> dentry.  We are in RCU mode, so we are not pinning the dentry and it
> might have reached dentry_free().  However, anything with DCACHE_RCUACCESS
> set would have freeing RCU-delayed, making that impossible.
>
> memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it
> plausible, but... there we really should've been stopped cold by
> the d_can_lookup() check - that is done while we are still holding
> a reference to struct file, which should've prevented freeing and
> reuse.  So at the time of that check we have dentry still not reused
> by anything, and d_can_lookup() should've failed.
>
> There is a race that could bugger the things up in that area, but it needs
> empty name, so this one is something else...

You can see from the log above that s always empty somehow, so the
d_can_lookup check is simply not done. I have not looked at the code,
but it's not racy, so should follow from the arguments passed to
name_to_handle_at.

Thread

fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-04 16:10 +0100
  Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-04 20:40 +0100
    Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:20 +0100
      Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:30 +0100
        Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:50 +0100
          Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 17:20 +0100
            Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 17:40 +0100
              Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 18:40 +0100
                Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 18:50 +0100
                Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 21:10 +0100
                Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-06 10:50 +0100
          Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 19:10 +0100
      Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:30 +0100

csiph-web