linux-kernel - null dereference in binfmt misc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171009211940.rtgjt7zayj5kftic@smitten>
Date:   Mon, 9 Oct 2017 15:19:40 -0600
From:   Tycho Andersen <tycho@...ho.ws>
To:     Oleg Nesterov <oleg@...hat.com>
Cc:     Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org
Subject: null dereference in binfmt misc

Hi,

It looks like eb23aa031 ("exec: binfmt_misc: remove the confusing
e->interp_file != NULL checks") uncovered a bug for me (see the trace below,
which I'm afraid isn't very helpful).

I have a fairly reliable reproducer, but before I dig in, I figured I'd ping
and see if anyone has any pointers on where to look.

Cheers,

Tycho

Oct  9 20:46:06 criu kernel: [   35.418432] BUG: unable to handle kernel NULL pointer dereference at 0000000000000013
Oct  9 20:46:06 criu kernel: [   35.419751] IP: bm_evict_inode+0x11/0x40
Oct  9 20:46:06 criu kernel: [   35.420361] PGD 0 P4D 0
Oct  9 20:46:06 criu kernel: [   35.420763] Oops: 0000 [#1] SMP
Oct  9 20:46:06 criu kernel: [   35.421258] Modules linked in: xt_mark fuse
Oct  9 20:46:06 criu kernel: [   35.421957] CPU: 3 PID: 1902 Comm: zdtm_ct Not tainted 4.14.0-rc4+ #35
Oct  9 20:46:06 criu kernel: [   35.422963] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1ubuntu1 04/01/2014
Oct  9 20:46:06 criu kernel: [   35.424356] task: ffff880133093200 task.stack: ffffc90000abc000
Oct  9 20:46:06 criu kernel: [   35.425312] RIP: 0010:bm_evict_inode+0x11/0x40
Oct  9 20:46:06 criu kernel: [   35.426003] RSP: 0018:ffffc90000abfc58 EFLAGS: 00010282
Oct  9 20:46:06 criu kernel: [   35.426813] RAX: ffffffff81211740 RBX: 0000000000000000 RCX: 0000000000000000
Oct  9 20:46:06 criu kernel: [   35.427916] RDX: 0000000000000001 RSI: 000000000000006b RDI: ffff880129955240
Oct  9 20:46:06 criu kernel: [   35.429012] RBP: ffffc90000abfc68 R08: ffff8801344ba330 R09: 00000001820001c5
Oct  9 20:46:06 criu kernel: [   35.430147] R10: ffffc90000abfdd0 R11: 0000000000001300 R12: ffff880129955240
Oct  9 20:46:06 criu kernel: [   35.431242] R13: ffffffff81820fa0 R14: ffff8801299552c8 R15: ffff8801299e6958
Oct  9 20:46:06 criu kernel: [   35.432345] FS:  00007f69f2b03700(0000) GS:ffff880139d80000(0000) knlGS:0000000000000000
Oct  9 20:46:06 criu kernel: [   35.433621] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Oct  9 20:46:06 criu kernel: [   35.434505] CR2: 0000000000000013 CR3: 0000000129220000 CR4: 00000000000006e0
Oct  9 20:46:06 criu kernel: [   35.435619] Call Trace:
Oct  9 20:46:06 criu kernel: [   35.435998]  evict+0xc2/0x190
Oct  9 20:46:06 criu kernel: [   35.436450]  iput+0x1de/0x230
Oct  9 20:46:06 criu kernel: [   35.436901]  dentry_unlink_inode+0xbd/0x160
Oct  9 20:46:06 criu kernel: [   35.437562]  __dentry_kill+0xba/0x160
Oct  9 20:46:06 criu kernel: [   35.438114]  shrink_dentry_list+0x114/0x2f0
Oct  9 20:46:06 criu kernel: [   35.438739]  shrink_dcache_parent+0x25/0x80
Oct  9 20:46:06 criu kernel: [   35.439365]  do_one_tree+0xd/0x50
Oct  9 20:46:06 criu kernel: [   35.439874]  shrink_dcache_for_umount+0x28/0x80
Oct  9 20:46:06 criu kernel: [   35.440551]  generic_shutdown_super+0x1a/0x110
Oct  9 20:46:06 criu kernel: [   35.441252]  kill_litter_super+0x24/0x40
Oct  9 20:46:06 criu kernel: [   35.441867]  deactivate_locked_super+0x39/0x70
Oct  9 20:46:06 criu kernel: [   35.442531]  deactivate_super+0x49/0x50
Oct  9 20:46:06 criu kernel: [   35.443105]  cleanup_mnt+0x3a/0x70
Oct  9 20:46:06 criu kernel: [   35.443626]  __cleanup_mnt+0xd/0x10
Oct  9 20:46:06 criu kernel: [   35.444151]  task_work_run+0x9a/0xd0
Oct  9 20:46:06 criu kernel: [   35.444690]  do_exit+0x313/0xc10
Oct  9 20:46:06 criu kernel: [   35.445215]  do_group_exit+0x42/0xc0
Oct  9 20:46:06 criu kernel: [   35.445751]  SyS_exit_group+0xf/0x10
Oct  9 20:46:06 criu kernel: [   35.446289]  entry_SYSCALL_64_fastpath+0x1a/0xa5
Oct  9 20:46:06 criu kernel: [   35.446979] RIP: 0033:0x7f69f25ed748
Oct  9 20:46:06 criu kernel: [   35.447530] RSP: 002b:00007fffc9953b08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
Oct  9 20:46:06 criu kernel: [   35.448611] RAX: ffffffffffffffda RBX: 00007f69f28e6540 RCX: 00007f69f25ed748
Oct  9 20:46:06 criu kernel: [   35.449667] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
Oct  9 20:46:06 criu kernel: [   35.450678] RBP: 0000000000000000 R08: 00000000000000e7 R09: ffffffffffffff98
Oct  9 20:46:06 criu kernel: [   35.451696] R10: 00007fffc9953a58 R11: 0000000000000246 R12: 00007f69f2b03700
Oct  9 20:46:06 criu kernel: [   35.452745] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Oct  9 20:46:06 criu kernel: [   35.453761] Code: 2f fd ff 85 c0 75 08 48 c7 43 30 a0 0f 82 81 5b 5d c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 54 53 48 8b 9f 38 02 00 00 49 89 fc <f6> 43 13 10 74 0b 48 8b 7b 48 31 f6 e8 9e 58 fa ff 4c 89 e7 e8
Oct  9 20:46:06 criu kernel: [   35.456484] RIP: bm_evict_inode+0x11/0x40 RSP: ffffc90000abfc58
Oct  9 20:46:06 criu kernel: [   35.457326] CR2: 0000000000000013
Oct  9 20:46:06 criu kernel: [   35.457807] ---[ end trace 773951adf548e79e ]---