linux-kernel - Re: [PATCH] exit: move exit_task_namespaces() after exit_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM_iQpWAY0uUHWPviWbPFMR7XHgsBOj4Mh_fcz83somD_1Piwg@mail.gmail.com>
Date:   Fri, 15 Dec 2017 15:59:46 -0800
From:   Cong Wang <xiyou.wangcong@...il.com>
To:     Al Viro <viro@...iv.linux.org.uk>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        stable <stable@...r.kernel.org>, gscrivan@...hat.com
Subject: Re: [PATCH] exit: move exit_task_namespaces() after exit_task_work()

On Thu, Dec 14, 2017 at 1:08 PM, Al Viro <viro@...iv.linux.org.uk> wrote:
> On Thu, Dec 14, 2017 at 12:17:57PM -0800, Cong Wang wrote:
>> syzbot reported we have a use-after-free when mqueue_evict_inode()
>> is called on __cleanup_mnt() path, where the ipc ns is already
>> freed by the previous exit_task_namespaces(). We can just move
>> it after after exit_task_work() to avoid this use-after-free.
>
> What's to prevent somebody else holding a reference to the same
> inode past the exit(2)?  IOW, I don't believe that this is fixing
> anything - in the best case, your patch papers over a specific
> reproducer.

You are right, I missed mq_clear_sbinfo().

And the offending commit is:

commit 9c583773d036336176e9e50441890659bc4eeae8
Author: Giuseppe Scrivano <gscrivan@...hat.com>
Date:   Fri Dec 15 01:06:28 2017 +0000

    ipc, mqueue: lazy call kern_mount_data in new namespaces

    kern_mount_data is a relatively expensive operation when creating a new
    IPC namespace, so delay the mount until its first usage when not creating
    the the global namespace.

    This is a net saving for new IPC namespaces that don't use mq_open().  In
    this case there won't be any kern_mount_data() cost at all.

    On my machine, the time for creating 1000 new IPC namespaces dropped from
    ~8s to ~2s.

    Link: http://lkml.kernel.org/r/20171206151422.9660-1-gscrivan@redhat.com
    Signed-off-by: Giuseppe Scrivano <gscrivan@...hat.com>
    Cc: Manfred Spraul <manfred@...orfullife.com>
    Cc: Davidlohr Bueso <dave@...olabs.net>
    Cc: Al Viro <viro@...iv.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>