linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Alexey Gladkov <legion@kernel.org>
To: Hillf Danton <hdanton@sina.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
	syzbot+01985d7909f9468f013c@syzkaller.appspotmail.com,
	syzbot+59dd63761094a80ad06d@syzkaller.appspotmail.com,
	syzbot+6cd79f45bb8fa1c9eeae@syzkaller.appspotmail.com,
	syzbot+b6e65bd125a05f803d6b@syzkaller.appspotmail.com,
	"Eric W. Biederman" <ebiederm@xmission.com>
Subject: Re: [PATCH v1] ucounts: Fix race condition between alloc_ucounts and put_ucounts
Date: Wed, 28 Jul 2021 14:24:48 +0200	[thread overview]
Message-ID: <20210728122448.lh2e3nr4txhsmcwt@example.org> (raw)
In-Reply-To: <20210728025837.1641-1-hdanton@sina.com>

On Wed, Jul 28, 2021 at 10:58:37AM +0800, Hillf Danton wrote:
> On Tue, 27 Jul 2021 17:24:18 +0200 Alexey Gladkov wrote:
> > +++ b/kernel/ucount.c
> > @@ -160,6 +160,7 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid)
> >  {
> >  	struct hlist_head *hashent = ucounts_hashentry(ns, uid);
> >  	struct ucounts *ucounts, *new;
> > +	long overflow;
> >  
> >  	spin_lock_irq(&ucounts_lock);
> >  	ucounts = find_ucounts(ns, uid, hashent);
> > @@ -184,8 +185,12 @@ struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid)
> >  			return new;
> >  		}
> >  	}
> > +	overflow = atomic_add_negative(1, &ucounts->count);
> >  	spin_unlock_irq(&ucounts_lock);
> > -	ucounts = get_ucounts(ucounts);
> > +	if (overflow) {
> > +		put_ucounts(ucounts);
> 
> Given 		  if (atomic_add_unless(atomic, -1, 1))
> 			return 0;
> 
> put can not help roll back overflow.

In case of overflow, we don't try to rollback overflow. We return an
error.

> BTW can you specify a bit on the real workloads with the risk of count overflow?

For example, one user has too many processes in one namespace.

It is necessary to check and handle the possibility of counter overflow
in this case. Linus described it here:

https://lore.kernel.org/lkml/CAHk-%3dwjYOCgM%2bmKzwTZwkDDg12DdYjFFkmoFKYLim7NFmR9HBg@mail.gmail.com/

> > +		return NULL;
> > +	}
> >  	return ucounts;
> >  }
> >  
> > @@ -193,8 +198,7 @@ void put_ucounts(struct ucounts *ucounts)
> >  {
> >  	unsigned long flags;
> >  
> > -	if (atomic_dec_and_test(&ucounts->count)) {
> > -		spin_lock_irqsave(&ucounts_lock, flags);
> > +	if (atomic_dec_and_lock_irqsave(&ucounts->count, &ucounts_lock, flags)) {
> >  		hlist_del_init(&ucounts->node);
> >  		spin_unlock_irqrestore(&ucounts_lock, flags);
> >  		kfree(ucounts);
> > -- 
> > 2.29.3
> 

-- 
Rgrds, legion


  parent reply	other threads:[~2021-07-28 12:24 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-17  6:22 [syzbot] KASAN: use-after-free Write in put_ucounts syzbot
     [not found] ` <20210719094432.425-1-hdanton@sina.com>
2021-07-19 17:24   ` Eric W. Biederman
2021-07-24 17:57     ` Alexey Gladkov
     [not found]   ` <20210720041451.766-1-hdanton@sina.com>
2021-07-20 16:29     ` Eric W. Biederman
2021-07-27 15:24 ` [PATCH v1] ucounts: Fix race condition between alloc_ucounts and put_ucounts Alexey Gladkov
     [not found] ` <20210728025837.1641-1-hdanton@sina.com>
2021-07-28 12:24   ` Alexey Gladkov [this message]
2021-07-28 17:05     ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210728122448.lh2e3nr4txhsmcwt@example.org \
    --to=legion@kernel.org \
    --cc=ebiederm@xmission.com \
    --cc=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+01985d7909f9468f013c@syzkaller.appspotmail.com \
    --cc=syzbot+59dd63761094a80ad06d@syzkaller.appspotmail.com \
    --cc=syzbot+6cd79f45bb8fa1c9eeae@syzkaller.appspotmail.com \
    --cc=syzbot+b6e65bd125a05f803d6b@syzkaller.appspotmail.com \
    --subject='Re: [PATCH v1] ucounts: Fix race condition between alloc_ucounts and put_ucounts' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).