linux-kernel - Re: [PATCH v2 2/7] fsnotify: pin both inode and vfsmount mark

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 30 Oct 2017 14:34:38 +0100
From:   Jan Kara <jack@...e.cz>
To:     Miklos Szeredi <mszeredi@...hat.com>
Cc:     linux-fsdevel@...r.kernel.org, Jan Kara <jack@...e.cz>,
        Amir Goldstein <amir73il@...il.com>,
        Xiong Zhou <xzhou@...hat.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/7] fsnotify: pin both inode and vfsmount mark

On Wed 25-10-17 10:41:34, Miklos Szeredi wrote:
> We may fail to pin one of the marks in fsnotify_prepare_user_wait() when
> dropping the srcu read lock, resulting in use after free at the next
> iteration.
> 
> Solution is to store both marks in iter_info instead of just the one we'll
> be sending the event for.

I'm sorry but I'm not getting it. Where exactly is use-after-free
happening? And how come because if fsnotify_prepare_user_wait() fails to
pin some mark, it does not drop SRCU and bails out, doesn't it?

								Honza
 
> diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
> index 0c4583b61717..48ec61f4c4d5 100644
> --- a/fs/notify/fsnotify.c
> +++ b/fs/notify/fsnotify.c
> @@ -336,6 +336,9 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
>  			vfsmount_group = vfsmount_mark->group;
>  		}
>  
> +		iter_info.inode_mark = inode_mark;
> +		iter_info.vfsmount_mark = vfsmount_mark;
> +
>  		if (inode_group && vfsmount_group) {
>  			int cmp = fsnotify_compare_groups(inode_group,
>  							  vfsmount_group);
> @@ -348,9 +351,6 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,
>  			}
>  		}
>  
> -		iter_info.inode_mark = inode_mark;
> -		iter_info.vfsmount_mark = vfsmount_mark;
> -
>  		ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask,
>  				    data, data_is, cookie, file_name,
>  				    &iter_info);
> -- 
> 2.5.5
> 
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR