linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Alexey Gladkov <legion@kernel.org>
To: Hillf Danton <hdanton@sina.com>
Cc: syzbot <syzbot+59dd63761094a80ad06d@syzkaller.appspotmail.com>,
	ebiederm@xmission.com, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Write in alloc_ucounts
Date: Sat, 14 Aug 2021 12:31:53 +0200	[thread overview]
Message-ID: <20210814103153.rzlgindblymmqcqi@example.org> (raw)
In-Reply-To: <20210814095036.2972-1-hdanton@sina.com>

On Sat, Aug 14, 2021 at 05:50:36PM +0800, Hillf Danton wrote:
> On Thu, 29 Jul 2021 10:15:28 -0700
> > syzbot has found a reproducer for the following issue on:
> > 
> > HEAD commit:    4010a528219e Merge tag 'fixes_for_v5.14-rc4' of git://git...
> > git tree:       upstream
> > console output: https://syzkaller.appspot.com/x/log.txt?x=133f4a66300000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=1dee114394f7d2c2
> > dashboard link: https://syzkaller.appspot.com/bug?extid=59dd63761094a80ad06d
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16b8851a300000
> > 
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+59dd63761094a80ad06d@syzkaller.appspotmail.com
> > 
> > ==================================================================
> > BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
> > BUG: KASAN: use-after-free in atomic_add_negative include/asm-generic/atomic-instrumented.h:556 [inline]
> > BUG: KASAN: use-after-free in get_ucounts kernel/ucount.c:152 [inline]
> > BUG: KASAN: use-after-free in get_ucounts kernel/ucount.c:150 [inline]
> > BUG: KASAN: use-after-free in alloc_ucounts+0x19b/0x5b0 kernel/ucount.c:188
> > Write of size 4 at addr ffff888017c0f61c by task syz-executor.0/12089

This is outdated report. It was sent before the fix was landed [1]. After
the fix, there were no reports about ucounts.

[1] https://lore.kernel.org/lkml/87a6lvak43.fsf@disp2133/

> In bid to fix the uaf, make get_ucounts() able to detect count underflow in
> addition to overflow by replacing atomic_add_negative() with
> atomic_try_cmpxchg(). Because the cmpxchg itself can not do the job without
> checking xflow, try to bump up count until xflow is detected.

The cmpxchg is much more expensive.

> #syz test git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4010a528219e 
> 
> --- x/kernel/ucount.c
> +++ y/kernel/ucount.c
> @@ -149,11 +149,18 @@ static void hlist_add_ucounts(struct uco
>  
>  struct ucounts *get_ucounts(struct ucounts *ucounts)
>  {
> -	if (ucounts && atomic_add_negative(1, &ucounts->count)) {
> -		put_ucounts(ucounts);
> -		ucounts = NULL;
> +	int count;
> +
> +	if (!ucounts)
> +		return NULL;
> +
> +	count = atomic_read(&ucounts->count);
> +
> +	while (count > 0 && count + 1 > count) {
> +		if (atomic_try_cmpxchg(&ucounts->count, &count, count + 1))
> +			return ucounts;
>  	}
> -	return ucounts;
> +	return NULL;
>  }
>  
>  struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid)
> @@ -184,8 +191,8 @@ struct ucounts *alloc_ucounts(struct use
>  			return new;
>  		}
>  	}
> -	spin_unlock_irq(&ucounts_lock);
>  	ucounts = get_ucounts(ucounts);
> +	spin_unlock_irq(&ucounts_lock);
>  	return ucounts;
>  }

I see that your patch is not for the most recent code. You are using the
old version of code.

-- 
Rgrds, legion


  parent reply	other threads:[~2021-08-14 10:32 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-17  6:21 syzbot
2021-07-29 17:15 ` syzbot
     [not found] ` <20210814095036.2972-1-hdanton@sina.com>
2021-08-14 10:31   ` Alexey Gladkov [this message]
2021-08-14 13:50   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210814103153.rzlgindblymmqcqi@example.org \
    --to=legion@kernel.org \
    --cc=ebiederm@xmission.com \
    --cc=hdanton@sina.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+59dd63761094a80ad06d@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --subject='Re: [syzbot] KASAN: use-after-free Write in alloc_ucounts' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).