linux-kernel - Re: [PATCH] copy_process: fix CLONE_PARENT && parent_exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090302215845.GA22307@redhat.com>
Date:	Mon, 2 Mar 2009 22:58:45 +0100
From:	Oleg Nesterov <oleg@...hat.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Roland McGrath <roland@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Chris Evans <scarybeasts@...il.com>,
	David Howells <dhowells@...hat.com>,
	Don Howard <dhoward@...hat.com>,
	Eugene Teo <eugene@...hat.com>,
	Michael Kerrisk <mtk.manpages@...glemail.com>,
	Tavis Ormandy <taviso@....lonestar.org>,
	Vitaly Mayatskikh <vmayatsk@...hat.com>, stable@...nel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] copy_process: fix CLONE_PARENT && parent_exec_id
	interaction

On 03/02, Linus Torvalds wrote:
> 
> 
> On Mon, 2 Mar 2009, Oleg Nesterov wrote:
> > 
> > I am re-sending this patch simplified to one-liner. If this patch is
> > accepted, I think it makes sense to move the first
> > "p->parent_exec_id = p->self_exec_id" in copy_process() down, under
> > the "else" branch. Just for readability.
> > 
> > Note! This patch doesn't even try to address the original CVE. Let me
> > repeat, I am not the security expert, please correct me. But, unless
> > parent or child change security context (via exec), it is OK to send
> > any ->exit_signal when the child exits.
> > 
> > Comments?
> 
> I think this looks correct and sane. And I agree with your "also move down 
> the "p->parent_exec_id = p->self_exec_id" thing. In fact, I'd agree with 
> it so much that I think it should be part of this patch, just because that 
> not only clarifies the code, but it also makes it more obvious what the 
> real change of this one single _patch_ is.

Agreed, please find v2 below. But I failed to make the comment...

Also, "p->parent_exec_id = current->parent_exec_id" is not really needed
in v2, it was already copied by dup_task_struct(). But I think it is better
to make the code a bit more explicit.

------------------
[PATCH v2] copy_process: fix CLONE_PARENT && parent_exec_id interaction

CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we
re-use the old parent, we must also re-use ->parent_exec_id to make
sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed
task exits.

Also, move down the "p->parent_exec_id = p->self_exec_id" thing, to place
two different cases together.

Signed-off-by: Oleg Nesterov <oleg@...hat.com>

--- 6.29-rc3/kernel/fork.c~3_CLONE_PARENT	2009-03-02 20:24:59.000000000 +0100
+++ 6.29-rc3/kernel/fork.c	2009-03-02 22:38:39.000000000 +0100
@@ -1177,10 +1177,6 @@ static struct task_struct *copy_process(
 #endif
 	clear_all_latency_tracing(p);
 
-	/* Our parent execution domain becomes current domain
-	   These must match for thread signalling to apply */
-	p->parent_exec_id = p->self_exec_id;
-
 	/* ok, now we should be set up.. */
 	p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
 	p->pdeath_signal = 0;
@@ -1218,10 +1214,13 @@ static struct task_struct *copy_process(
 		set_task_cpu(p, smp_processor_id());
 
 	/* CLONE_PARENT re-uses the old parent */
-	if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
-	else
+		p->parent_exec_id = current->parent_exec_id;
+	} else {
 		p->real_parent = current;
+		p->parent_exec_id = current->self_exec_id;
+	}
 
 	spin_lock(&current->sighand->siglock);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/