linux-kernel - Re: sched, timers: use after free in __lock_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140714090449.GL9918@twins.programming.kicks-ass.net>
Date:	Mon, 14 Jul 2014 11:04:49 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Sasha Levin <sasha.levin@...cle.com>
Cc:	Ingo Molnar <mingo@...nel.org>,
	John Stultz <john.stultz@...aro.org>,
	Thomas Gleixner <tglx@...utronix.de>,
	Frederic Weisbecker <fweisbec@...il.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Dave Jones <davej@...hat.com>,
	Andrey Ryabinin <a.ryabinin@...sung.com>,
	Oleg Nesterov <oleg@...hat.com>
Subject: Re: sched, timers: use after free in __lock_task_sighand when
 exiting a process

On Sun, Jul 13, 2014 at 07:45:56PM -0400, Sasha Levin wrote:
> On 07/13/2014 05:51 PM, Sasha Levin wrote:
> > Hi all,
> > 
> > While fuzzing with trinity inside a KVM tools guest running the latest -next
> > kernel with the KASAN patchset, I've stumbled on the following spew:

WTH is a KASAN?

> Alrighty, I don't think it has anything to do with timers:
> 
> [  876.319044] ==================================================================
> [  876.319044] AddressSanitizer: use after free in do_raw_spin_unlock+0x4b/0x1a0 at addr ffff8803e48cec18
> [  876.319044] page:ffffea000f923380 count:0 mapcount:0 mapping:          (null) index:0x0
> [  876.319044] page flags: 0x2fffff80008000(tail)
> [  876.319044] page dumped because: kasan error
> [  876.319044] CPU: 26 PID: 8749 Comm: trinity-watchdo Tainted: G        W      3.16.0-rc4-next-20140711-sasha-00046-g07d3099-dirty #817
> [  876.319044]  00000000000000fb 0000000000000000 ffffea000f923380 ffff8805c417fc70
> [  876.319044]  ffffffff9de47068 ffff8805c417fd40 ffff8805c417fd30 ffffffff99426f5c
> [  876.319044]  0000000000000010 0000000000000000 ffff8805c417fc9d 66666620000000a8
> [  876.319044] Call Trace:
> [  876.319044] dump_stack (lib/dump_stack.c:52)
> [  876.319044] kasan_report_error (mm/kasan/report.c:98 mm/kasan/report.c:166)
> [  876.319044] __asan_load8 (mm/kasan/kasan.c:364)
> [  876.319044] do_raw_spin_unlock (./arch/x86/include/asm/current.h:14 kernel/locking/spinlock_debug.c:99 kernel/locking/spinlock_debug.c:158)
> [  876.319044] _raw_spin_unlock (include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:183)
> [  876.319044] __lock_task_sighand (include/linux/rcupdate.h:858 kernel/signal.c:1285)
> [  876.319044] do_send_sig_info (kernel/signal.c:1191)
> [  876.319044] group_send_sig_info (kernel/signal.c:1304)
> [  876.319044] kill_pid_info (kernel/signal.c:1339)
> [  876.319044] SYSC_kill (kernel/signal.c:1423 kernel/signal.c:2900)

Oleg, what guarantees the RCU free of task-struct and sighand?

The only RCU I can find is delayed_put_task_struct() but that's not
often used. TASK_DEAD etc. use regular put_task_struct() and that
doesn't seem to involve RCU.

Could be I'm a moron, its Monday, and its relatively early, so I'll go
have another look..


Content of type "application/pgp-signature" skipped