Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1592807

Re: fs: use-after-free in path_lookupat

Show all headers | View raw

On Sun, Mar 5, 2017 at 5:33 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote:
>> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
>> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote:
>> >
>> >> I am pretty sure it is that one.
>> >> I don't think I ever used name_to_handle_at syscall in my life and I
>> >> definitely didn't make it lookup a memfd :)
>> >
>> > So what does it normally return?  On the runs where we do not hit that
>> > use-after-free, that is.
>> >
>> > What gets triggered there is nd->path.dentry pointing to already freed
>> > dentry.  We are in RCU mode, so we are not pinning the dentry and it
>> > might have reached dentry_free().  However, anything with DCACHE_RCUACCESS
>> > set would have freeing RCU-delayed, making that impossible.
>> >
>> > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it
>> > plausible, but... there we really should've been stopped cold by
>> > the d_can_lookup() check - that is done while we are still holding
>> > a reference to struct file, which should've prevented freeing and
>> > reuse.  So at the time of that check we have dentry still not reused
>> > by anything, and d_can_lookup() should've failed.
>> >
>> > There is a race that could bugger the things up in that area, but it needs
>> > empty name, so this one is something else...
>>
>> You can see from the log above that s always empty somehow, so the
>> d_can_lookup check is simply not done. I have not looked at the code,
>> but it's not racy, so should follow from the arguments passed to
>> name_to_handle_at.
>
> Umm...  name_to_handle_at() in your log:
> name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000)
> and unless I'm misreading what you are printing there, you have "./bus0"
> passed as the second argument.  Right?  That's pretty much why I asked about
> other possible calls triggering it...
>
> If you are somehow getting there with empty name and if there's another
> thread closing these memfd descriptors, I understand what's going on there.
> It's how we are getting that empty name on your syscall arguments that
> looks very odd...


Added more debug output.

name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300",
&(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0,
0x1000)

actually passes name="" because of the overlapping addresses. Flags
contain AT_EMPTY_PATH.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-04 16:10 +0100
  Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-04 20:40 +0100
    Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:20 +0100
      Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:30 +0100
        Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:50 +0100
          Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 17:20 +0100
            Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 17:40 +0100
              Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 18:40 +0100
                Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 18:50 +0100
                Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 21:10 +0100
                Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-06 10:50 +0100
          Re: fs: use-after-free in path_lookupat Al Viro <viro@ZenIV.linux.org.uk> - 2017-03-05 19:10 +0100
      Re: fs: use-after-free in path_lookupat Dmitry Vyukov <dvyukov@google.com> - 2017-03-05 12:30 +0100

csiph-web