lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 21 Dec 2017 12:38:12 +0200
From:   Alexey Dobriyan <>
To:     "Eric W. Biederman" <>
Cc:     Dave Jones <>,
        Linus Torvalds <>,
        Al Viro <>,
        Linux Kernel <>,, Gargi Sharma <>,
        Oleg Nesterov <>,
        Rik van Riel <>,
        Andrew Morton <>
Subject: Re: proc_flush_task oops

On 12/21/17, Eric W. Biederman <> wrote:
> I have stared at this code, and written some test programs and I can't
> see what is going on.  alloc_pid by design and in implementation (as far
> as I can see) is always single threaded when allocating the first pid
> in a pid namespace.  idr_init always initialized idr_next to 0.
> So how we can get past:
> 	if (unlikely(is_child_reaper(pid))) {
> 		if (pid_ns_prepare_proc(ns)) {
> 			disable_pid_allocation(ns);
> 			goto out_free;
> 		}
> 	}
> with proc_mnt still set to NULL is a mystery to me.
> Is there any chance the idr code doesn't always return the lowest valid
> free number?  So init gets assigned something other than 1?

Well, this theory is easy to test (attached).

There is a "valid" way to break the code via kernel.ns_last_pid:
unshare+write+fork but the reproducer doesn't seem to use it (or it does?)

View attachment "pid1.diff" of type "text/plain" (1214 bytes)

Powered by blists - more mailing lists