linux-kernel - Procfs race condition bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140704101311.GA7020@glue.grepular.com>
Date:	Fri, 4 Jul 2014 11:13:11 +0100
From:	Mike Cardwell <linux@...ts.grepular.com>
To:	linux-kernel@...r.kernel.org
Subject: Procfs race condition bug

I originally posted this two years ago (*) but received no response. I
just had a look and the problem still exists on the 3.14 kernel I am
currently running.

I *think* I've uncovered a race condition bug in procfs. If I attempt to
open a file in /proc/net, eg "/proc/net/tcp" it works fine, but if I
spawn a POSIX thread and attempt to do it from there, it *usually* fails
with a "No such file or directory", but some times succeeds. If I do a
system call inside the thread to look up the thread ID and then open
"/proc/THREADID/net/tcp" instead, it works fine.

There are more details and some example code so you can replicate the
problem on a stack overflow question I asked previously here:
http://stackoverflow.com/questions/11580020/opening-proc-net-tcp-in-c-from-a-posix-thread-fails-most-of-the-time

(*) https://lkml.org/lkml/2012/7/20/331

-- 
Mike Cardwell  https://grepular.com https://emailprivacytester.com
OpenPGP Key    35BC AF1D 3AA2 1F84 3DC3   B0CF 70A5 F512 0018 461F
XMPP OTR Key   8924 B06A 7917 AAF3 DBB1   BF1B 295C 3C78 3EF1 46B4

Download attachment "signature.asc" of type "application/pgp-signature" (599 bytes)