linux-kernel - Re: [PATCH] Fix UTS corruption during clone(CLONE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20070914200215.GA25105@vino.hallyn.com>
Date:	Fri, 14 Sep 2007 15:02:15 -0500
From:	"Serge E. Hallyn" <serge@...lyn.com>
To:	Alexey Dobriyan <adobriyan@...ru>
Cc:	akpm@...l.org, linux-kernel@...r.kernel.org, devel@...nvz.org
Subject: Re: [PATCH] Fix UTS corruption during clone(CLONE_NEWUTS)

Quoting Alexey Dobriyan (adobriyan@...ru):
> struct utsname is copied from master one without any exclusion.
> 
> Here is sample output from one proggie doing
> 
> 	sethostname("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
> 	sethostname("bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb");
> 
> and another
> 
> 	clone(,, CLONE_NEWUTS, ...)
> 	uname()
> 
> 
> 	hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaabbbbb'
> 	hostname = 'bbbaaaaaaaaaaaaaaaaaaaaaaaaaaa'
> 	hostname = 'aaaaaaaabbbbbbbbbbbbbbbbbbbbbb'
> 	hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaabbbb'
> 	hostname = 'aaaaaaaaaaaaaaaaaaaaaaaaaaaabb'
> 	hostname = 'aaabbbbbbbbbbbbbbbbbbbbbbbbbbb'
> 	hostname = 'bbbbbbbbbbbbbbbbaaaaaaaaaaaaaa'
> 
> Hostname is sometimes corrupted.
> 
> Yes, even _the_ simplest namespace activity had bug in it. :-(
> 
> Signed-off-by: Alexey Dobriyan <adobriyan@...ru>

picking my jaw up off the floor just long enough to type

Signed-off-by: Serge Hallyn <serue@...ibm.com>

and limp away in shame

thanks Alexey,
-serge

> ---
> 
>  kernel/utsname.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> --- a/kernel/utsname.c
> +++ b/kernel/utsname.c
> @@ -28,7 +28,9 @@ static struct uts_namespace *clone_uts_ns(struct uts_namespace *old_ns)
>  	if (!ns)
>  		return ERR_PTR(-ENOMEM);
>  
> +	down_read(&uts_sem);
>  	memcpy(&ns->name, &old_ns->name, sizeof(ns->name));
> +	up_read(&uts_sem);
>  	kref_init(&ns->kref);
>  	return ns;
>  }
> 
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/