linux-kernel - Re: [PATCH] Re: [PATCH] sched, cgroup: Use exit hook to avoid use-after-free crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1294042885.2016.11.camel@laptop>
Date:	Mon, 03 Jan 2011 09:21:25 +0100
From:	Peter Zijlstra <peterz@...radead.org>
To:	Mike Galbraith <efault@....de>
Cc:	Ingo Molnar <mingo@...e.hu>, Miklos Vajna <vmiklos@...galware.org>,
	shenghui <crosslonelyover@...il.com>,
	kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org,
	Greg KH <greg@...ah.com>, Paul Turner <pjt@...gle.com>,
	Yong Zhang <yong.zhang0@...il.com>,
	Li Zefan <lizf@...fujitsu.com>,
	Paul Menage <menage@...gle.com>,
	Balbir Singh <balbir@...ux.vnet.ibm.com>,
	Srivatsa Vaddagiri <vatsa@...ibm.com>
Subject: Re: [PATCH] Re: [PATCH] sched, cgroup: Use exit hook to avoid
 use-after-free crash

On Fri, 2010-12-31 at 09:32 +0100, Mike Galbraith wrote:

> sched: fix autogroup reference leak and cpu_cgroup_exit() explosion
> 
> In the event of a fork failure, the new cpu_cgroup_exit() method tries to
> move an unhashed task.  Since PF_EXITING isn't set in that case, autogroup
> will dig aground in a freed signal_struct.  Neither cgroups nor autogroup
> has anything it needs to do with this shade, so don't go there.
> 
> This also uncovered a struct autogroup reference leak. copy_process() was
> simply freeing vs putting the signal_struct, stranding a reference.
> 
> Signed-off-by: Mike Galbraith <efault@....de>
> 
> ---
>  kernel/fork.c  |    2 +-
>  kernel/sched.c |   10 ++++++++++
>  2 files changed, 11 insertions(+), 1 deletion(-)
> 
> Index: linux-2.6.37.git/kernel/fork.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/fork.c
> +++ linux-2.6.37.git/kernel/fork.c
> @@ -1318,7 +1318,7 @@ bad_fork_cleanup_mm:
>  	}
>  bad_fork_cleanup_signal:
>  	if (!(clone_flags & CLONE_THREAD))
> -		free_signal_struct(p->signal);
> +		put_signal_struct(p->signal);
>  bad_fork_cleanup_sighand:
>  	__cleanup_sighand(p->sighand);
>  bad_fork_cleanup_fs:
> Index: linux-2.6.37.git/kernel/sched.c
> ===================================================================
> --- linux-2.6.37.git.orig/kernel/sched.c
> +++ linux-2.6.37.git/kernel/sched.c
> @@ -9193,6 +9193,16 @@ cpu_cgroup_attach(struct cgroup_subsys *
>  static void
>  cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
>  {
> +	/*
> +	 * cgroup_exit() is called in the copy_process failure path.
> +	 * The task isn't hashed, and we don't want to make autogroup
> +	 * dig into a freed signal_struct, so just go away.
> +	 *
> +	 * XXX: why are cgroup methods diddling unattached tasks?
> +	 */
> +	if (!(task->flags & PF_EXITING))
> +		return;
> +
>  	sched_move_task(task);
>  }

Ah, that looks plausible. I've folded this chunk into my patch and kept
your fork-fail mod in a separate patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/