linux-kernel - Re: [PATCH] sched, cgroup: Use exit hook to avoid use-after-free crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20101229152522.GA23825@elte.hu>
Date:	Wed, 29 Dec 2010 16:25:22 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	Mike Galbraith <efault@....de>,
	Miklos Vajna <vmiklos@...galware.org>,
	shenghui <crosslonelyover@...il.com>,
	kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org,
	Greg KH <greg@...ah.com>, Paul Turner <pjt@...gle.com>,
	Yong Zhang <yong.zhang0@...il.com>,
	Li Zefan <lizf@...fujitsu.com>,
	Paul Menage <menage@...gle.com>,
	Balbir Singh <balbir@...ux.vnet.ibm.com>,
	Srivatsa Vaddagiri <vatsa@...ibm.com>
Subject: Re: [PATCH] sched, cgroup: Use exit hook to avoid use-after-free
 crash


I tried this patch, but it causes a boot crash:

udevd[109]: delete_path: rmdir(/dev/.udev/failed) failed: Read-only file sgeneral protection fault: 0000 [#1] SMP 
last sysfs file: /sys/bus/mdio_bus/drivers/Generic PHY/uevent
CPU 0 
Modules linked in:

ystem
udevd[10Pid: 109, comm: udevd Not tainted 2.6.37-rc8-tip-01815-g4e7b4f4-dirty #76296 A8N-E/System Product Name
RIP: 0010:[<ffffffff810276ff>] 9]: delete_path: [<ffffffff810276ff>] task_group+0x4d/0x53
RSP: 0018:ffff88003d33bd50  EFLAGS: 00010046
RAX: 6b6b6b6b6b6b6b6b RBX: ffff88003d06f460 RCX: ffffffff00000000
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff88003d06f460
 rmdir(/dev/.udeRBP: ffff88003d33bd50 R08: ffff88003e40ad68 R09: 000000000000005a
R10: ffff88003f7d62c8 R11: ffff88003d086d80 R12: 0000000000000000
v/failed) failedR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f0b23077780(0000) GS:ffff88003fc00000(0000) knlGS:0000000000000000
: Read-only fileCS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f0b222cb000 CR3: 000000003d36d000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
 system
udevd[DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process udevd (pid: 109, threadinfo ffff88003d33a000, task ffff88003e63ee40)
Stack:
 ffff88003d33bd70 ffffffff8102771c ffff88003d06f460 0000000000000000
 ffff88003d33bd90 ffffffff81027c9c ffff88003d06f460 ffff88003fc11000
 ffff88003d33bdd0 ffffffff81034d6d109]: delete_pat ffff88003d06f460 0000000000000246
Call Trace:
 [<ffffffff8102771c>] set_task_rq+0x17/0x73
h: rmdir(/dev/.u [<ffffffff81027c9c>] task_move_group_fair+0x37/0x53
dev/failed) fail [<ffffffff81034d6d>] sched_move_task+0x71/0xbc
ed: Read-only fi [<ffffffff81034dc9>] cpu_cgroup_exit+0x11/0x13
 [<ffffffff81070e88>] cgroup_exit+0x35/0xd4
le system
udev [<ffffffff8103706a>] copy_process+0xf3a/0xfc7
d[109]: delete_p [<ffffffff81037283>] do_fork+0x163/0x2d7
 [<ffffffff810b456a>] ? do_munmap+0x2f2/0x30b
 [<ffffffff8100a0c2>] sys_clone+0x28/0x2a
ath: rmdir(/dev/ [<ffffffff81002cf3>] stub_clone+0x13/0x20
 [<ffffffff81002a8b>] ? system_call_fastpath+0x16/0x1b
Code: 15 cb 0f 4e 00 85 .udev/failed) fad2 74 12 48 3d 30 03 5a 81 75 0a 48 81 7f 30 90 ad 33 81 iled: Read-only 74 02 c9 c3 48 8b 87 00 04 00 00 48 8b 80 70 01 00 00 <48> 8b 40 08 eb ea 55 48 89 e5 41 54 53 e8 6f b1 fd ff 48 89 fb 
RIP  [<ffffffff810276ff>] task_group+0x4d/0x53
 RSP <ffff88003d33bd50>
---[ end trace cde1903a0ae5345d ]---
Kernel panic - not syncing: Fatal exception
Pid: 109, comm: udevd Tainted: G      D     2.6.37-rc8-tip-01815-g4e7b4f4-dirty #76296
Call Trace:
 [<ffffffff8132a7d6>] ? panic+0x91/0x194
 [<ffffffff8103931c>] ? kmsg_dump+0x11a/0x136
 [<ffffffff8132d357>] ? oops_end+0xae/0xbe
 [<ffffffff810060eb>] ? die+0x5a/0x63
 [<ffffffff8132cdaa>] ? do_general_protection+0x133/0x13b
 [<ffffffff8132c8af>] ? general_protection+0x1f/0x30
 [<ffffffff810276ff>] ? task_group+0x4d/0x53
 [<ffffffff8102771c>] ? set_task_rq+0x17/0x73
 [<ffffffff81027c9c>] ? task_move_group_fair+0x37/0x53
 [<ffffffff81034d6d>] ? sched_move_task+0x71/0xbc
 [<ffffffff81034dc9>] ? cpu_cgroup_exit+0x11/0x13
 [<ffffffff81070e88>] ? cgroup_exit+0x35/0xd4
 [<ffffffff8103706a>] ? copy_process+0xf3a/0xfc7
 [<ffffffff81037283>] ? do_fork+0x163/0x2d7
 [<ffffffff810b456a>] ? do_munmap+0x2f2/0x30b
 [<ffffffff8100a0c2>] ? sys_clone+0x28/0x2a
 [<ffffffff81002cf3>] ? stub_clone+0x13/0x20
 [<ffffffff81002a8b>] ? system_call_fastpath+0x16/0x1b


Config attached.

	Ingo

View attachment "config" of type "text/plain" (66783 bytes)