linux-kernel - Resolving executable name / reading vma->vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2c03f9590907072251q4d6b17fan7c7bb391b9d2f70a@mail.gmail.com>
Date:	Wed, 8 Jul 2009 02:51:06 -0300
From:	"Lucas C. Villa Real" <lucasvr@...olinux.org>
To:	linux-kernel@...r.kernel.org
Subject: Resolving executable name / reading vma->vm_flags

Hi, all,

I'm currently running into an issue which seems to have started after
I introduced a change to Audit which is still under testing.
audit_filter_syscall() was modified to also collect the process'
executable name and use that to perform extra comparisons.

The problem is that sometimes, during reboots, I get general
protection failures in _spin_lock+0 which never appeared before.
Verifying the processor context through the Crash utility I see that
the spinlock structure provided to _spin_lock is valid and contains a
reasonable value (lock->slock == 1).

However, I always see that new function listed in the backtrace in
another processor, so I must believe that has something to do with the
failure.

My question is: is there a chance that something can go wrong when
calling d_path() on vma->vm_file, even though mm->mmap_sem is held?
Any conditions, restrictions or calling conventions that I may not be
aware of?

The function is listed below. Please note that this function is called
from process context during system calls and the contexts in which
it's called allow the caller to sleep. It returns a pointer to the
offset in kfree_ptr where the resolved path starts.

static char *audit_get_task_exe(char **kfree_ptr, struct task_struct *tsk)
{
        struct mm_struct *mm = get_task_mm(tsk);
        struct vm_area_struct *vma;
        char *path, *name_ptr = NULL;

        if (! mm) {
                /* Task has no mm or is a kernel thread which is doing
async I/O */
                return NULL;
        }

        path = kmalloc(PATH_MAX, GFP_KERNEL);
        if (!path) {
                mmput(mm);
                return NULL;
        }

        /* Look for the executable name in the task's list of mmap'd areas */
        down_read(&mm->mmap_sem);
        vma = mm->mmap;
        while (vma) {
                if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file) {
                        name_ptr = d_path(&vma->vm_file->f_path, path,
PATH_MAX);
                        if (IS_ERR(name_ptr)) {
                                name_ptr = NULL;
                                goto out;
                        }
                        *kfree_ptr = path;
                        break;
                }
                vma = vma->vm_next;
        }

out:
        up_read(&mm->mmap_sem);
        mmput(mm);
        if (unlikely(!name_ptr))
                kfree(path);
        return name_ptr;
}

Any comments are greatly appreciated. Thanks!

Lucas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/