linux-kernel - Re: PROBLEM: /proc/$pid/ns/ access of zombies dies with null pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m1wrgmdb1j.fsf@fess.ebiederm.org>
Date:	Wed, 15 Jun 2011 14:44:56 -0700
From:	ebiederm@...ssion.com (Eric W. Biederman)
To:	Ingo Saitz <Ingo.Saitz@...d.uni-hannover.de>
Cc:	Daniel Lezcano <daniel.lezcano@...e.fr>,
	"David S. Miller" <davem@...emloft.net>,
	linux-kernel@...r.kernel.org
Subject: Re: PROBLEM: /proc/$pid/ns/ access of zombies dies with null pointer

Ingo Saitz <Ingo.Saitz@...d.uni-hannover.de> writes:

> [1.] One line summary of the problem:
>
> /proc/$pid/ns/ access of zombies dies with null pointer
>
>
> [2.] Full description of the problem/report:
>
> Linux 3.0 introduced /proc/$pid/ns/ directories. The contents of these
> produce a null pointer BUG if the $pid belongs to a zombie process.
>
> This bug can be triggered e.g. by doing a ls in /proc/$pid/ns/ from
> a zombie process.
>
> The kernel switches to a text console and prints the bug on it, and the
> keyboard is not working. But otherwise it seems to run fine, after a
> chvt from a remote login. Only the program accessing the file in proc (ls)
> was killed.

This fixes it for me.  Can you confirm?

>From 793925334f32e9026c22baee5c3c340f47d4ef7e Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@...ssion.com>
Date: Wed, 15 Jun 2011 12:47:04 -0700
Subject: [PATCH] proc: Fix Oops on stat of /proc/<zombie pid>/ns/net

Don't call iput with the inode half setup to be a namespace filedescriptor.
Instead rearrange the code so that we don't initialize ei->ns_ops until
after I ns_ops->get succeeds, preventing us from invoking ns_ops->put
when ns_ops->get failed.

Reported-by: Ingo Saitz <Ingo.Saitz@...d.uni-hannover.de>
Signed-off-by: Eric W. Biederman <ebiederm@...ssion.com>
---
 fs/proc/namespaces.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index 781dec5..be177f7 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -38,18 +38,21 @@ static struct dentry *proc_ns_instantiate(struct inode *dir,
 	struct inode *inode;
 	struct proc_inode *ei;
 	struct dentry *error = ERR_PTR(-ENOENT);
+	void *ns;
 
 	inode = proc_pid_make_inode(dir->i_sb, task);
 	if (!inode)
 		goto out;
 
+	ns = ns_ops->get(task);
+	if (!ns)
+		goto out_iput;
+
 	ei = PROC_I(inode);
 	inode->i_mode = S_IFREG|S_IRUSR;
 	inode->i_fop  = &ns_file_operations;
 	ei->ns_ops    = ns_ops;
-	ei->ns	      = ns_ops->get(task);
-	if (!ei->ns)
-		goto out_iput;
+	ei->ns	      = ns;
 
 	dentry->d_op = &pid_dentry_operations;
 	d_add(dentry, inode);
-- 
1.7.5.1.217.g4e3aa

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/