linux-kernel - Re: KASAN: use-after-free Read in link_path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180724051726.GH30522@ZenIV.linux.org.uk>
Date:   Tue, 24 Jul 2018 06:17:26 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     "Dae R. Jeong" <threeearcat@...il.com>
Cc:     linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
        byoungyoung@...due.edu, kt0755@...il.com, bammanag@...due.edu
Subject: Re: KASAN: use-after-free Read in link_path_walk

On Tue, Jul 24, 2018 at 12:45:42PM +0900, Dae R. Jeong wrote:
> Diagnosis:
> We think that it is possible that link_path_walk() dereferences a
> freed pointer when cleanup_mnt() is executed between path_init() and
> link_path_walk().
> 
> Since I'm not an expert on a file system and don't fully understand
> the crash, please see a executed program and a crash log below in
> case that my understanding is wrong.
> 
> 
> Executed Program:
> Thread0                     Thread1
> mkdir("./file0")
>      |--------------------------|
>      |                      mount("./file0", "./file0", "devpts", 0x0, "")
>      |                          |
> openat(AT_FDCWD,            chroot("./file0")
> "/dev/vcs", 0x200, 0x0)     umount("./file0", 0x2)
> 
> openat(), chroot(), umount() syscalls are executed after mount() syscall.
> We think a race occurs between openat() and chroot() because RaceFuzzer
> executed openat() and chroot() concurrently.
> 
> 
> (Possible) Thread interleaving:
> CPU0 (path_openat)                      CPU1 (cleanup_mnt)
> =====                                   =====
> s = path_init(nd, flags);
> if (IS_ERR(s)) {
>           put_filp(file);
>                   return ERR_CAST(s);
> }
> 
>                                         deactivate_super(mnt->mnt.mnt_sb);
> 
> while (!(error = link_path_walk(s, nd)) &&
> 
> // (in link_path_walk())
> struct dentry *parent = nd->path.dentry;
> nd->flags &= ~LOOKUP_JUMPED;
> if (unlikely(parent->d_flags & DCACHE_OP_HASH)) { // UAF occured

Do we have LOOKUP_RCU in nd->flags at that point?  And how in hell
did we get that dentry there?  In LOOKUP_RCU mode no freeing should
be happening until after we call rcu_read_unlock(), unless the final
dput() has happened before rcu_read_lock().  In which case we shouldn't
have gotten to that dentry in the first place.  And in non-LOOKUP_RCU
mode we are bloody well holding references to everything (vfsmount
and dentry alike), so that deactivate_super() shouldn't have been
called as long as we are holding that reference.

Details, please.  Ideally - how to reproduce that.