linux-kernel - Re: [RFC]: Possible race condition on an SMP between proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <m1hcy8gox7.fsf@ebiederm.dsl.xmission.com>
Date:	Fri, 13 Oct 2006 10:29:08 -0600
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Chandru <chandru@...ibm.com>
Cc:	linux-kernel@...r.kernel.org, Andrew Morton <akpm@...l.org>
Subject: Re: [RFC]: Possible race condition on an SMP between proc_lookupfd and tasks on other cpus

Chandru <chandru@...ibm.com> writes:

> Eric W. Biederman wrote:
>> You certain seem to be in one of the proc stress conditions so this
>> may not be a unique bug.
>>
>> Digging through the disassembly and figuring out which access you died
>> on would be interesting, so we could know with precision which part
>> of tid_fd_revalidate we are dying in.  My ppc64 isn't good enough especially
>> without the matching binaries to figure that out though.
>> All I know is that you are about 25 instructions into
>> tid_fd_revalidate.
>>
> From the disassembly in xmon, the code that failed while running was in
> fcheck_files() called from tid_fd_revalidate()

> Further the contents of 'struct files_struct *files' were all filled with
> '0x6b's.  I tried to look in to for which task the lookup was being done and the
> task seemed to be 'execve04'.  Also noticed that another cpu ( cpu #1)  was
> running on an execve code path ( do not have the state of the system right now
> to copy it's backtrace  :(  ).

Which kernel version did you say you were running.

This appears to be a case of calling put_files_struct without changing
the pointer in the task_struct.  So we are reading a stale pointer
in get_files_struct.

It looks like the patch below added fixed a bug that has the same symptoms
as what you are describing.  So I suspect this is fixed in linus's tree
already.

>commit 3b9b8ab65d8eed784b9164d03807cb2bda7b5cd6
>Author: Kirill Korotaev <dev@...ru>
>Date:   Fri Sep 29 02:00:05 2006 -0700
>
>    [PATCH] Fix unserialized task->files changing
>    
>    Fixed race on put_files_struct on exec with proc.  Restoring files on
>    current on error path may lead to proc having a pointer to already kfree-d
>    files_struct.
>    
>    ->files changing at exit.c and khtread.c are safe as exit_files() makes all
>    things under lock.
>    
>    Found during OpenVZ stress testing.
>    
>    [akpm@...l.org: add export]
>    Signed-off-by: Pavel Emelianov <xemul@...nvz.org>
>    Signed-off-by: Kirill Korotaev <dev@...nvz.org>
>    Signed-off-by: Andrew Morton <akpm@...l.org>
>    Signed-off-by: Linus Torvalds <torvalds@...l.org>


Eric
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/