From: Alexey Gladkov <gladkov.alexey@gmail.com>
To: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
Linux API <linux-api@vger.kernel.org>,
Linux FS Devel <linux-fsdevel@vger.kernel.org>,
Linux Security Module <linux-security-module@vger.kernel.org>,
Akinobu Mita <akinobu.mita@gmail.com>,
Alexander Viro <viro@zeniv.linux.org.uk>,
Alexey Dobriyan <adobriyan@gmail.com>,
Andrew Morton <akpm@linux-foundation.org>,
Andy Lutomirski <luto@kernel.org>,
Daniel Micay <danielmicay@gmail.com>,
Djalal Harouni <tixxdz@gmail.com>,
"Dmitry V . Levin" <ldv@altlinux.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Ingo Molnar <mingo@kernel.org>,
"J . Bruce Fields" <bfields@fieldses.org>,
Jeff Layton <jlayton@poochiereds.net>,
Jonathan Corbet <corbet@lwn.net>,
Kees Cook <keescook@chromium.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Oleg Nesterov <oleg@redhat.com>,
David Howells <dhowells@redhat.com>
Subject: Re: [PATCH v13 2/7] proc: allow to mount many instances of proc in one pid namespace
Date: Thu, 23 Apr 2020 22:01:36 +0200 [thread overview]
Message-ID: <20200423200136.zrjzv6d6zghnvvrx@comp-core-i7-2640m-0182e6> (raw)
In-Reply-To: <87lfmmz9bs.fsf@x220.int.ebiederm.org>
On Thu, Apr 23, 2020 at 07:16:07AM -0500, Eric W. Biederman wrote:
>
> I took a quick look and there is at least one other use in security/tomoyo/realpath.c:
>
> static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
> const int buflen)
> {
> struct super_block *sb = dentry->d_sb;
> char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
>
> if (IS_ERR(pos))
> return pos;
> /* Convert from $PID to self if $PID is current thread. */
> if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
> char *ep;
> const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
>
> if (*ep == '/' && pid && pid ==
> task_tgid_nr_ns(current, sb->s_fs_info)) {
> pos = ep - 5;
> if (pos < buffer)
> goto out;
> memmove(pos, "/self", 5);
> }
> goto prepend_filesystem_name;
> }
Ooops. I missed this one. I thought I found all such cases.
> Can you make the fixes to locks.c and tomoyo a couple of standalone
> fixes that should be inserted before your patch?
Sure.
> On the odd chance there is a typo they will bisect better, as well
> as just keeping this patch and it's description from expanding in size.
> So that things are small enough for people to really look at and review.
>
> The fix itself looks fine.
>
> Thank you,
> Eric
>
>
> Alexey Gladkov <gladkov.alexey@gmail.com> writes:
>
> > Fixed getting proc_pidns in the lock_get_status() and locks_show() directly from
> > the superblock, which caused a crash:
> >
> > === arm64 ===
> > [12140.366814] LTP: starting proc01 (proc01 -m 128)
> > [12149.580943] ==================================================================
> > [12149.589521] BUG: KASAN: out-of-bounds in pid_nr_ns+0x2c/0x90 pid_nr_ns at kernel/pid.c:456
> > [12149.595939] Read of size 4 at addr 1bff000bfa8c0388 by task = proc01/50298
> > [12149.603392] Pointer tag: [1b], memory tag: [fe]
> >
> > [12149.610906] CPU: 69 PID: 50298 Comm: proc01 Tainted: G L 5.7.0-rc2-next-20200422 #6
> > [12149.620585] Hardware name: HPE Apollo 70 /C01_APACHE_MB , BIOS L50_5.13_1.11 06/18/2019
> > [12149.631074] Call trace:
> > [12149.634304] dump_backtrace+0x0/0x22c
> > [12149.638745] show_stack+0x28/0x34
> > [12149.642839] dump_stack+0x104/0x194
> > [12149.647110] print_address_description+0x70/0x3a4
> > [12149.652576] __kasan_report+0x188/0x238
> > [12149.657169] kasan_report+0x3c/0x58
> > [12149.661430] check_memory_region+0x98/0xa0
> > [12149.666303] __hwasan_load4_noabort+0x18/0x20
> > [12149.671431] pid_nr_ns+0x2c/0x90
> > [12149.675446] locks_translate_pid+0xf4/0x1a0
> > [12149.680382] locks_show+0x68/0x110
> > [12149.684536] seq_read+0x380/0x930
> > [12149.688604] pde_read+0x5c/0x78
> > [12149.692498] proc_reg_read+0x74/0xc0
> > [12149.696813] __vfs_read+0x84/0x1d0
> > [12149.700939] vfs_read+0xec/0x124
> > [12149.704889] ksys_read+0xb0/0x120
> > [12149.708927] __arm64_sys_read+0x54/0x88
> > [12149.713485] do_el0_svc+0x128/0x1dc
> > [12149.717697] el0_sync_handler+0x150/0x250
> > [12149.722428] el0_sync+0x164/0x180
> >
> > [12149.728672] Allocated by task 1:
> > [12149.732624] __kasan_kmalloc+0x124/0x188
> > [12149.737269] kasan_kmalloc+0x10/0x18
> > [12149.741568] kmem_cache_alloc_trace+0x2e4/0x3d4
> > [12149.746820] proc_fill_super+0x48/0x1fc
> > [12149.751377] vfs_get_super+0xcc/0x170
> > [12149.755760] get_tree_nodev+0x28/0x34
> > [12149.760143] proc_get_tree+0x24/0x30
> > [12149.764439] vfs_get_tree+0x54/0x158
> > [12149.768736] do_mount+0x80c/0xaf0
> > [12149.772774] __arm64_sys_mount+0xe0/0x18c
> > [12149.777504] do_el0_svc+0x128/0x1dc
> > [12149.781715] el0_sync_handler+0x150/0x250
> > [12149.786445] el0_sync+0x164/0x180
>
> > diff --git a/fs/locks.c b/fs/locks.c
> > index b8a31c1c4fff..399c5dbb72c4 100644
> > --- a/fs/locks.c
> > +++ b/fs/locks.c
> > @@ -2823,7 +2823,7 @@ static void lock_get_status(struct seq_file *f, struct file_lock *fl,
> > {
> > struct inode *inode = NULL;
> > unsigned int fl_pid;
> > - struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
> > + struct pid_namespace *proc_pidns = proc_pid_ns(file_inode(f->file));
> >
> > fl_pid = locks_translate_pid(fl, proc_pidns);
> > /*
> > @@ -2901,7 +2901,7 @@ static int locks_show(struct seq_file *f, void *v)
> > {
> > struct locks_iterator *iter = f->private;
> > struct file_lock *fl, *bfl;
> > - struct pid_namespace *proc_pidns = file_inode(f->file)->i_sb->s_fs_info;
> > + struct pid_namespace *proc_pidns = proc_pid_ns(file_inode(f->file));
> >
> > fl = hlist_entry(v, struct file_lock, fl_link);
> >
>
> Eric
>
--
Rgrds, legion
next prev parent reply other threads:[~2020-04-23 20:02 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-19 14:10 [PATCH v12 0/7] proc: modernize proc to support multiple private instances Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 1/7] proc: rename struct proc_fs_info to proc_fs_opts Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 2/7] proc: allow to mount many instances of proc in one pid namespace Alexey Gladkov
2020-04-23 11:28 ` [PATCH v13 " Alexey Gladkov
2020-04-23 12:16 ` Eric W. Biederman
2020-04-23 20:01 ` Alexey Gladkov [this message]
2020-04-19 14:10 ` [PATCH v12 3/7] proc: instantiate only pids that we can ptrace on 'hidepid=4' mount option Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 4/7] proc: add option to mount only a pids subset Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 5/7] docs: proc: add documentation for "hidepid=4" and "subset=pid" options and new mount behavior Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 6/7] proc: use human-readable values for hidepid Alexey Gladkov
2020-04-19 14:10 ` [PATCH v12 7/7] proc: use named enums for better readability Alexey Gladkov
[not found] ` <87ftcv1nqe.fsf@x220.int.ebiederm.org>
2020-04-23 17:54 ` [PATCH v2 0/2] proc: Calling proc_flush_task exactly once per task Oleg Nesterov
2020-04-23 19:38 ` Eric W. Biederman
2020-04-23 19:39 ` [PATCH v2 1/2] proc: Use PIDTYPE_TGID in next_tgid Eric W. Biederman
2020-04-24 17:29 ` Oleg Nesterov
2020-04-23 19:39 ` [PATCH v2 2/2] proc: Ensure we see the exit of each process tid exactly Eric W. Biederman
2020-04-23 20:28 ` Linus Torvalds
2020-04-24 3:33 ` Eric W. Biederman
2020-04-24 18:02 ` Linus Torvalds
2020-04-24 18:46 ` Linus Torvalds
2020-04-24 19:51 ` Eric W. Biederman
2020-04-24 20:10 ` Linus Torvalds
2020-04-24 17:39 ` Oleg Nesterov
2020-04-24 18:10 ` Eric W. Biederman
2020-04-24 20:50 ` [PATCH] proc: Put thread_pid in release_task not proc_flush_pid Eric W. Biederman
[not found] ` <87mu6ymkea.fsf_-_@x220.int.ebiederm.org>
[not found] ` <87blnemj5t.fsf_-_@x220.int.ebiederm.org>
2020-04-26 17:22 ` [PATCH v3 2/6] posix-cpu-timers: Use PIDTYPE_TGID to simplify the logic in lookup_task Oleg Nesterov
2020-04-27 11:51 ` Eric W. Biederman
2020-04-28 18:03 ` Oleg Nesterov
2020-04-27 10:32 ` Thomas Gleixner
2020-04-27 19:46 ` Eric W. Biederman
[not found] ` <875zdmmj4y.fsf_-_@x220.int.ebiederm.org>
2020-04-26 17:40 ` [PATCH v3 3/6] rculist: Add hlist_swap_before_rcu Linus Torvalds
2020-04-27 14:28 ` Eric W. Biederman
2020-04-27 20:27 ` Linus Torvalds
2020-04-28 12:16 ` [PATCH v4 0/2] proc: Ensure we see the exit of each process tid exactly Eric W. Biederman
2020-04-28 12:18 ` [PATCH v4 1/2] rculist: Add hlists_swap_heads_rcu Eric W. Biederman
2020-04-28 12:19 ` [PATCH v4 2/2] proc: Ensure we see the exit of each process tid exactly once Eric W. Biederman
2020-04-28 16:53 ` [PATCH v4 0/2] proc: Ensure we see the exit of each process tid exactly Linus Torvalds
2020-04-28 17:55 ` Eric W. Biederman
2020-04-28 18:55 ` Eric W. Biederman
2020-04-28 19:36 ` Linus Torvalds
2020-04-28 18:05 ` Oleg Nesterov
2020-04-28 18:54 ` Eric W. Biederman
2020-04-28 21:39 ` [PATCH v1 0/4] signal: Removing has_group_leader_pid Eric W. Biederman
2020-04-28 21:45 ` [PATCH v1 1/4] posix-cpu-timer: Tidy up group_leader logic in lookup_task Eric W. Biederman
2020-04-28 21:48 ` [PATCH 2/4] posix-cpu-timer: Unify the now redundant code " Eric W. Biederman
2020-04-28 21:53 ` [PATCH v1 3/4] exec: Remove BUG_ON(has_group_leader_pid) Eric W. Biederman
2020-04-28 21:56 ` [PATCH v4 4/4] signal: Remove has_group_leader_pid Eric W. Biederman
2020-04-30 11:54 ` [PATCH v1 0/3] posix-cpu-timers: Use pids not tasks in lookup Eric W. Biederman
2020-04-30 11:55 ` [PATCH v1 1/3] posix-cpu-timers: Extend rcu_read_lock removing task_struct references Eric W. Biederman
2020-04-30 11:56 ` [PATCH v1 2/3] posix-cpu-timers: Replace cpu_timer_pid_type with clock_pid_type Eric W. Biederman
2020-04-30 11:56 ` [PATCH v1 3/3] posix-cpu-timers: Replace __get_task_for_clock with pid_for_clock Eric W. Biederman
[not found] ` <87h7x6mj6h.fsf_-_@x220.int.ebiederm.org>
2020-04-27 9:43 ` [PATCH v3 1/6] posix-cpu-timers: Always call __get_task_for_clock holding rcu_read_lock Thomas Gleixner
2020-04-27 11:53 ` Eric W. Biederman
[not found] ` <87r1w8ete7.fsf@x220.int.ebiederm.org>
2020-04-27 20:23 ` [PATCH v3] proc: Ensure we see the exit of each process tid exactly Eric W. Biederman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200423200136.zrjzv6d6zghnvvrx@comp-core-i7-2640m-0182e6 \
--to=gladkov.alexey@gmail.com \
--cc=adobriyan@gmail.com \
--cc=akinobu.mita@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=bfields@fieldses.org \
--cc=corbet@lwn.net \
--cc=danielmicay@gmail.com \
--cc=dhowells@redhat.com \
--cc=ebiederm@xmission.com \
--cc=gregkh@linuxfoundation.org \
--cc=jlayton@poochiereds.net \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=ldv@altlinux.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=tixxdz@gmail.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).