lkml.org 
[lkml]   [2018]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: KASAN: use-after-free Read in alloc_pid
From
Date
On 2018/04/03 12:10, Eric Biggers wrote:
> On Mon, Apr 02, 2018 at 06:00:57PM -0500, Eric W. Biederman wrote:
>> syzbot <syzbot+7a1cff37dbbef9e7ba4c@syzkaller.appspotmail.com> writes:
>>
>>> Hello,
>>>
>>> syzbot hit the following crash on upstream commit
>>> 9dd2326890d89a5179967c947dab2bab34d7ddee (Fri Mar 30 17:29:47 2018 +0000)
>>> Merge tag 'ceph-for-4.16-rc8' of git://github.com/ceph/ceph-client
>>> syzbot dashboard link:
>>> https://syzkaller.appspot.com/bug?extid=7a1cff37dbbef9e7ba4c
>>>
>>> So far this crash happened 4 times on upstream.
>>>
>>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> Do you have any of the other traces? This looks like a something is
>> calling put_pid_ns more than it is calling get_pid_ns causing a
>> reference count mismatch.
>>
>> If this is not: 9ee332d99e4d5a97548943b81c54668450ce641b

Yes, that commit is the trigger. Al wrote patches. Let's check them.

http://lkml.kernel.org/r/20180402143415.GC30522@ZenIV.linux.org.uk
http://lkml.kernel.org/r/20180403052009.GH30522@ZenIV.linux.org.uk

----------
struct pid *alloc_pid(struct pid_namespace *ns) {
(...snipped...)
if (unlikely(is_child_reaper(pid))) {
if (pid_ns_prepare_proc(ns)) // ns is freed upon failure.
goto out_free;
}
(...snipped...)
out_free:
spin_lock_irq(&pidmap_lock);
while (++i <= ns->level) // <= ns is already freed by destroy_pid_namespace() explained below.
idr_remove(&ns->idr, (pid->numbers + i)->nr);
(...snipped...)
}
----------

----------
int pid_ns_prepare_proc(struct pid_namespace *ns) {
mnt = kern_mount_data(&proc_fs_type, ns) { // <= ns is passed as ns.
mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, data) { // <= ns is passed as data.
root = mount_fs(type, SB_KERNMOUNT, name, data) { // <= ns is passed as data.
root = type->mount(type, SB_KERNMOUNT, name, data) = // <= ns is passed as data.
static struct dentry *proc_mount(struct file_system_type *fs_type, int flags, const char *dev_name, void *data) {
return mount_ns(fs_type, SB_KERNMOUNT, NULL, ns, ns->user_ns, proc_fill_super) { // <= ns is passed as ns.
sb = sget_userns(fs_type, ns_test_super, ns_set_super, SB_KERNMOUNT, user_ns, ns) { // <= ns is passed as ns.
err = set(s, data) = // <= ns is passed as data.
static int ns_set_super(struct super_block *sb, void *data) {
sb->s_fs_info = data; // ns is associated here.
}
err = register_shrinker(&s->s_shrink); // <= fail by fault injection.
deactivate_locked_super(s) {
fs->kill_sb(s) =
static void proc_kill_sb(struct super_block *sb) {
ns = (struct pid_namespace *)sb->s_fs_info;
put_pid_ns(ns) { // <= ns is passed as ns
kref_put(&ns->kref, free_pid_ns) { // <= ns refcount becomes 0
destroy_pid_namespace(ns) {
call_rcu(&ns->rcu, delayed_free_pidns) {
kmem_cache_free(pid_ns_cachep, ns); // <= ns is released here after RCU grace period
}
}
}
}
}
}
}
}
}
}
}
}
}
----------

>>
>> I could use a few more hints to help narrow down what is going wrong.
>>
>> It would be nice to know what the other 3 crashes looked like and
>> exactly which upstream they were on.
>>
>
> The other crashes are shown on the syzbot dashboard (link was given in the
> original email).
>
> Eric
>

\
 
 \ /
  Last update: 2018-04-03 12:47    [W:0.058 / U:1.696 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site