From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751933AbdCEQdG (ORCPT <rfc822;w@1wt.eu>);
        Sun, 5 Mar 2017 11:33:06 -0500
Received: from zeniv.linux.org.uk ([195.92.253.2]:39578 "EHLO
        ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1750814AbdCEQdF (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Sun, 5 Mar 2017 11:33:05 -0500
Date: Sun, 5 Mar 2017 16:33:01 +0000
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: "linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>
Subject: Re: fs: use-after-free in path_lookupat
Message-ID: <20170305163301.GJ29622@ZenIV.linux.org.uk>
References: <CACT4Y+bWe1bhVKmH4v1RrhQYUKzwu9BG1COaffx-4J2nnzPO-A@mail.gmail.com>
 <20170304193910.GG29622@ZenIV.linux.org.uk>
 <CACT4Y+Y23b8QhB8Hmasr5jXtwAwvvY=wVrorgRHzUWcdspURMg@mail.gmail.com>
 <CACT4Y+YNak+YLMpEGrTP5iwtrKB=Csd25fWKAT9hLYRYY6YzGQ@mail.gmail.com>
 <CACT4Y+ZNiki1Xdpe_m-=Tk+7TpeZNnvV-tq=cNai=Xs7dr0rbw@mail.gmail.com>
 <CACT4Y+ZHgE2r9fGsDS_7CHsxa53yrsx0Zp0TBvH4oeqg24w5Yg@mail.gmail.com>
 <20170305155707.GI29622@ZenIV.linux.org.uk>
 <CACT4Y+b2mfMmm1evdWn7PHkNOe1xhwtxqtUB83oawNRQ1ZzbKA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACT4Y+b2mfMmm1evdWn7PHkNOe1xhwtxqtUB83oawNRQ1ZzbKA@mail.gmail.com>
User-Agent: Mutt/1.7.1 (2016-10-04)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote:
> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote:
> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote:
> >
> >> I am pretty sure it is that one.
> >> I don't think I ever used name_to_handle_at syscall in my life and I
> >> definitely didn't make it lookup a memfd :)
> >
> > So what does it normally return?  On the runs where we do not hit that
> > use-after-free, that is.
> >
> > What gets triggered there is nd->path.dentry pointing to already freed
> > dentry.  We are in RCU mode, so we are not pinning the dentry and it
> > might have reached dentry_free().  However, anything with DCACHE_RCUACCESS
> > set would have freeing RCU-delayed, making that impossible.
> >
> > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it
> > plausible, but... there we really should've been stopped cold by
> > the d_can_lookup() check - that is done while we are still holding
> > a reference to struct file, which should've prevented freeing and
> > reuse.  So at the time of that check we have dentry still not reused
> > by anything, and d_can_lookup() should've failed.
> >
> > There is a race that could bugger the things up in that area, but it needs
> > empty name, so this one is something else...
> 
> You can see from the log above that s always empty somehow, so the
> d_can_lookup check is simply not done. I have not looked at the code,
> but it's not racy, so should follow from the arguments passed to
> name_to_handle_at.

Umm...  name_to_handle_at() in your log:
name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000)
and unless I'm misreading what you are printing there, you have "./bus0"
passed as the second argument.  Right?  That's pretty much why I asked about
other possible calls triggering it...

If you are somehow getting there with empty name and if there's another
thread closing these memfd descriptors, I understand what's going on there.
It's how we are getting that empty name on your syscall arguments that
looks very odd...