From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
To: Al Viro <viro@zeniv.linux.org.uk>, linux-fsdevel@vger.kernel.org
Cc: syzbot <syzbot+0341f6a4d729d4e0acf1@syzkaller.appspotmail.com>,
jmorris@namei.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, serge@hallyn.com,
syzkaller-bugs@googlegroups.com, takedakn@nttdata.co.jp
Subject: Re: KASAN: use-after-free Read in tomoyo_realpath_from_path
Date: Thu, 06 Jun 2019 14:20:39 +0900 [thread overview]
Message-ID: <201906060520.x565Kd8j017983@www262.sakura.ne.jp> (raw)
In-Reply-To: 0000000000004f43fa058a97f4d3@google.com
Tetsuo Handa wrote:
> The problem is that TOMOYO is accessing already freed socket from security_file_open()
> which later fails with -ENXIO (because we can't get file descriptor of sockets via
> /proc/pid/fd/n interface), and the file descriptor is getting released before
> security_file_open() completes because we do not raise "struct file"->f_count of
> the file which is accessible via /proc/pid/fd/n interface. We can avoid this problem
> if we can avoid calling security_file_open() which after all fails with -ENXIO.
> How should we handle this race? Let LSM modules check if security_file_open() was
> called on a socket?
Well, just refusing security_file_open() is not sufficient, for open(O_PATH) allows installing
file descriptor where SOCKET_I(inode)->sk can change at any moment, and TOMOYO cannot tell
whether it is safe to access SOCKET_I(inode)->sk from security_inode_getattr().
But refusing open(O_PATH) as well might break userspace programs. Oh, no...
----------------------------------------
diff --git a/fs/open.c b/fs/open.c
index b5b80469b93d..ea69668e2cd8 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -728,6 +728,16 @@ static int do_dentry_open(struct file *f,
/* Ensure that we skip any errors that predate opening of the file */
f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
+ /*
+ * Sockets must not be opened via /proc/pid/fd/n, even with O_PATH,
+ * for SOCKET_I(inode)->sk can be kfree()d at any moment after a file
+ * descriptor obtained by opening /proc/pid/fd/n was installed.
+ */
+ if (unlikely(S_ISSOCK(inode->i_mode))) {
+ error = (f->f_flags & O_PATH) ? -ENOENT : -ENXIO;
+ goto cleanup_file;
+ }
+
if (unlikely(f->f_flags & O_PATH)) {
f->f_mode = FMODE_PATH | FMODE_OPENED;
f->f_op = &empty_fops;
----------------------------------------
----------------------------------------
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/socket.h>
int main(int argc, char *argv[])
{
pid_t pid = getpid();
int fd = socket(AF_INET, SOCK_STREAM, 0);
char buffer[128] = { };
if (fork() == 0) {
struct stat buf = { };
close(fd);
snprintf(buffer, sizeof(buffer) - 1, "/proc/%u/fd/%u", pid, fd);
fd = open(buffer, __O_PATH);
sleep(5);
fstat(fd, &buf);
_exit(0);
}
sleep(2);
close(fd);
return 0;
}
----------------------------------------
next prev parent reply other threads:[~2019-06-06 5:21 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <0000000000004f43fa058a97f4d3@google.com>
2019-06-06 2:08 ` KASAN: use-after-free Read in tomoyo_realpath_from_path Tetsuo Handa
2019-06-06 5:20 ` Tetsuo Handa [this message]
2019-06-09 6:41 ` [PATCH] tomoyo: Don't check open/getattr permission on sockets Tetsuo Handa
2019-06-16 6:49 ` Tetsuo Handa
2019-06-18 20:49 ` Al Viro
2019-06-22 4:45 ` [PATCH v2] " Tetsuo Handa
2019-08-22 6:30 ` Eric Biggers
2019-08-22 6:55 ` Tetsuo Handa
2019-08-22 7:01 ` Eric Biggers
2019-08-22 7:42 ` Tetsuo Handa
2019-08-22 15:47 ` Eric Biggers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201906060520.x565Kd8j017983@www262.sakura.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=jmorris@namei.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=syzbot+0341f6a4d729d4e0acf1@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=takedakn@nttdata.co.jp \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).