lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 31 Aug 2013 05:53:11 +0000 From: "Liu, Chuansheng" <chuansheng.liu@...el.com> To: Al Viro <viro@...IV.linux.org.uk> CC: Eric Dumazet <eric.dumazet@...il.com>, "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Liu, Chuansheng" <chuansheng.liu@...el.com> Subject: RE: [PATCH] Fix the race between the fget() and close() Hello Al, > -----Original Message----- > From: Al Viro [mailto:viro@....linux.org.uk] On Behalf Of Al Viro > Sent: Tuesday, August 27, 2013 8:49 AM > To: Liu, Chuansheng > Cc: Eric Dumazet; linux-fsdevel@...r.kernel.org; linux-kernel@...r.kernel.org > Subject: Re: [PATCH] Fix the race between the fget() and close() > > On Tue, Aug 27, 2013 at 01:42:47AM +0100, Al Viro wrote: > > Might be buggered refcounting on struct file somewhere (i.e. extra fput() > done, > > getting the file freed *before* close(), leaving a dangling pointer in > > descriptor table). Might be memory corruption of some kind, slapping junk > > pointer into descriptor table. Might be buggered refcounting on struct > > dentry - if extra dput() is done somewhere, dentry might get freed under > > us or become negative. > > > > Hell, might be buggered refcounting on descriptor table - binder is playing > > interesting games there. Try to reproduce that with > CONFIG_DEBUG_KMEMLEAK > > and slab debugging turned on, see if you hit anything from those; if it's > > more or less readily reproducible, I would start with that - too many > > scenarios involve broken refcounting of one sort or another. > > Nevermind dentry refcounting - you get NULL dentry, not NULL inode. > Other scenarios still remain, so I'd really recommend slab/kmemleak > debugging turned on. I think I found one of possible race here(two processes P1 and P2): P1 has the the files_struct pointer FILES1, P2 has the files_struct pointer FILES2, When P1 open file, the new struct file pointer SHARE_FILE will be installed into FILES1, and file refcount is 1; And in P1, we can get P2's files_struct FILES2, and thru _fd_install(), we can add SHARE_FILE into P2's FILES2. Then the same file pointer SHARE_FILE stayed in both P1 and P2's files_struct, and the panic case will happen: P1 P2 Open the SHARE_FILE Installed SHARE_FILE into P2's file_struct FILES2 Ioctl(SHARE_FILE) When P2 exiting, fget_light() due to FILES1->refcount is 1, put_files_struct will be called, there will be no RCU and SHARE_FILE refcount increasing will close all files including SHARE_FILE But at this time, P1 is still operate SHARE_FILE without the refcount safety. Then the panic will happen at vfs_ioctl() due to the SHARE_FILE has been freed. Is it allowable that installing one file pointer into another FILES_STRUCT? Seems binder is doing the similar things. In fact, if in ioctl function, we can call fget() instead of fget_light(), this panic can be avoided. Is it making sense? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists