From: Eric Biggers <ebiggers3@gmail.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: syzbot
<bot+998c483ca801a50e3ce5b63a845216588ada5e2a@syzkaller.appspotmail.com>,
linux-fsdevel@vger.kernel.org,
LKML <linux-kernel@vger.kernel.org>,
syzkaller-bugs@googlegroups.com,
Al Viro <viro@zeniv.linux.org.uk>,
Andrea Arcangeli <aarcange@redhat.com>,
Pavel Emelyanov <xemul@parallels.com>,
linux-mm@kvack.org
Subject: Re: KASAN: use-after-free Read in handle_userfault
Date: Sun, 26 Nov 2017 22:15:17 -0800 [thread overview]
Message-ID: <20171127061517.GA26341@zzz.localdomain> (raw)
In-Reply-To: <CACT4Y+ZrYTNHDN71ZO1-vhFuCE=sRhfXeLbLom=9XodT7TJtog@mail.gmail.com>
+Cc aarcange@redhat.com, xemul@parallels.com, linux-mm@kvack.org
On Fri, Oct 27, 2017 at 11:46:13AM +0200, Dmitry Vyukov wrote:
> On Fri, Oct 27, 2017 at 11:44 AM, syzbot
> <bot+998c483ca801a50e3ce5b63a845216588ada5e2a@syzkaller.appspotmail.com>
> wrote:
> > Hello,
> >
> > syzkaller hit the following crash on
> > a31cc455c512f3f1dd5f79cac8e29a7c8a617af8
> > git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/master
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached
> > Raw console output is attached.
> > C reproducer is attached
> > syzkaller reproducer is attached. See https://goo.gl/kgGztJ
> > for information about syzkaller reproducers
>
Andrea or Pavel, can one of you please fix this? It's another use-after-free
related to userfaultfd "fork events", and it can easily be triggered by an
unprivileged user. It was reported a month ago already; the original report is
here: https://groups.google.com/forum/#!topic/syzkaller-bugs/sS99S-Z-9No.
(Please consider adding yourself and/or linux-mm to the MAINTAINERS file for
fs/userfaultfd.c, so that you are Cc'ed on userfaultfd bug reports.) In
userfaultfd_event_wait_completion(), called from dup_fctx(), the kernel is
freeing the the new userfaultfd_ctx because the old one had all its fd's closed,
but actually the new one is still in use by the new mm_struct.
Also, I've simplified the C reproducer:
#include <linux/sched.h>
#include <linux/userfaultfd.h>
#include <pthread.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <unistd.h>
static int userfaultfd;
static void *page;
static void *close_fd_proc(void *arg)
{
usleep(1000);
close(userfaultfd);
return NULL;
}
int main()
{
pthread_t t;
struct uffdio_api api = { 0 };
struct uffdio_register reg = { 0 };
page = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
userfaultfd = syscall(__NR_userfaultfd, 0);
api.api = UFFDIO;
api.features = UFFD_FEATURE_EVENT_FORK;
ioctl(userfaultfd, UFFDIO_API, &api);
reg.range.start = (__u64)page;
reg.range.len = 4096;
reg.mode = UFFDIO_REGISTER_MODE_MISSING;
ioctl(userfaultfd, UFFDIO_REGISTER, ®);
pthread_create(&t, NULL, close_fd_proc, NULL);
syscall(__NR_clone, CLONE_FILES, page, NULL, NULL, NULL);
return 0;
}
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-11-27 6:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-27 9:44 KASAN: use-after-free Read in handle_userfault syzbot
2017-10-27 9:46 ` Dmitry Vyukov
2017-11-27 6:15 ` Eric Biggers [this message]
2018-01-09 21:59 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171127061517.GA26341@zzz.localdomain \
--to=ebiggers3@gmail.com \
--cc=aarcange@redhat.com \
--cc=bot+998c483ca801a50e3ce5b63a845216588ada5e2a@syzkaller.appspotmail.com \
--cc=dvyukov@google.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=viro@zeniv.linux.org.uk \
--cc=xemul@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).