linux-kernel - Re: cgroup: BUG: unable to handle kernel NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160103005916.GA5956@mail.hallyn.com>
Date:	Sat, 2 Jan 2016 18:59:16 -0600
From:	"Serge E. Hallyn" <serge.hallyn@...ntu.com>
To:	Jeremiah Mahler <jmmahler@...il.com>,
	"Serge E. Hallyn" <serge.hallyn@...ntu.com>,
	Tejun Heo <tj@...nel.org>, cgroups@...r.kernel.org,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	linux-kernel@...r.kernel.org,
	Dan Williams <dan.j.williams@...el.com>
Subject: Re: cgroup: BUG: unable to handle kernel NULL pointer dereference

On Sat, Jan 02, 2016 at 01:50:49PM -0800, Jeremiah Mahler wrote:
> Serge,
> 
> On Sat, Jan 02, 2016 at 12:24:16PM -0600, Serge E. Hallyn wrote:
> [...]
> > 
> > Tried to reproduce with setting CONFIG_CFQ_GROUP_IOSCHED=y, but did not
> > succeed.  Could you send me the .config?  Also, if someone could send
> > the objdump -d output that might help.  Though really, it seems clear
> > that current->nsproxy must be NULL.  Hm, that's right -  we used to have
> > that issue in pidns (or was it netns) during process exit.  I don't know
> > that I'll get time this afternoon, but I'll look into it asap.
> > 
> > thanks.
> 
> Attached is the .config I used.  I can send an objdump, but do you want
> a dump of the kernel, where the cgroup code is?
> 
> -- 
> - Jeremiah Mahler

Thanks - Shoulda looked at the exit path before - exit_io_context is called
after exit_task_namespaces().

I'll have to figure out the best way to handle this.  In the past we've
restructured exit code to ensure that anything wanting to dereference
nsproxy happened before exit_task_namespaces().  However, this is only
happening in a debug stmt at blkg_path() in
http://lxr.free-electrons.com/source/include/linux/blk-cgroup.h#L344
so simply returning the init_cgroup_namespace is actually the right thing
to do.  I'm tempted to add a init_cgroup_path() which ignores namespaces,
for use in debugging statements.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/