From: Al Viro <viro@ZenIV.linux.org.uk>
To: "Dae R. Jeong" <threeearcat@gmail.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
byoungyoung@purdue.edu, kt0755@gmail.com, bammanag@purdue.edu
Subject: Re: KASAN: use-after-free Read in link_path_walk
Date: Tue, 24 Jul 2018 06:17:26 +0100 [thread overview]
Message-ID: <20180724051726.GH30522@ZenIV.linux.org.uk> (raw)
In-Reply-To: <20180724034542.GA19283@dragonet>
On Tue, Jul 24, 2018 at 12:45:42PM +0900, Dae R. Jeong wrote:
> Diagnosis:
> We think that it is possible that link_path_walk() dereferences a
> freed pointer when cleanup_mnt() is executed between path_init() and
> link_path_walk().
>
> Since I'm not an expert on a file system and don't fully understand
> the crash, please see a executed program and a crash log below in
> case that my understanding is wrong.
>
>
> Executed Program:
> Thread0 Thread1
> mkdir("./file0")
> |--------------------------|
> | mount("./file0", "./file0", "devpts", 0x0, "")
> | |
> openat(AT_FDCWD, chroot("./file0")
> "/dev/vcs", 0x200, 0x0) umount("./file0", 0x2)
>
> openat(), chroot(), umount() syscalls are executed after mount() syscall.
> We think a race occurs between openat() and chroot() because RaceFuzzer
> executed openat() and chroot() concurrently.
>
>
> (Possible) Thread interleaving:
> CPU0 (path_openat) CPU1 (cleanup_mnt)
> ===== =====
> s = path_init(nd, flags);
> if (IS_ERR(s)) {
> put_filp(file);
> return ERR_CAST(s);
> }
>
> deactivate_super(mnt->mnt.mnt_sb);
>
> while (!(error = link_path_walk(s, nd)) &&
>
> // (in link_path_walk())
> struct dentry *parent = nd->path.dentry;
> nd->flags &= ~LOOKUP_JUMPED;
> if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { // UAF occured
Do we have LOOKUP_RCU in nd->flags at that point? And how in hell
did we get that dentry there? In LOOKUP_RCU mode no freeing should
be happening until after we call rcu_read_unlock(), unless the final
dput() has happened before rcu_read_lock(). In which case we shouldn't
have gotten to that dentry in the first place. And in non-LOOKUP_RCU
mode we are bloody well holding references to everything (vfsmount
and dentry alike), so that deactivate_super() shouldn't have been
called as long as we are holding that reference.
Details, please. Ideally - how to reproduce that.
next prev parent reply other threads:[~2018-07-24 6:22 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-24 3:45 KASAN: use-after-free Read in link_path_walk Dae R. Jeong
2018-07-24 4:08 ` DaeRyong Jeong
2018-07-24 5:17 ` Al Viro [this message]
2018-07-24 5:29 ` Al Viro
2018-07-24 5:54 ` DaeRyong Jeong
2018-08-06 13:01 ` Al Viro
2018-11-28 17:40 syzbot
2019-03-25 4:52 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180724051726.GH30522@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=bammanag@purdue.edu \
--cc=byoungyoung@purdue.edu \
--cc=kt0755@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=threeearcat@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).