linux-kernel - Re: NULL pointer dereference when access /proc/net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YIb4xIU6x5BLe0wd@zeniv-ca.linux.org.uk>
Date:   Mon, 26 Apr 2021 17:30:44 +0000
From:   Al Viro <viro@...iv.linux.org.uk>
To:     haosdent <haosdent@...il.com>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        zhengyu.duan@...pee.com, Haosong Huang <huangh@....com>
Subject: Re: NULL pointer dereference when access /proc/net

On Tue, Apr 27, 2021 at 01:16:44AM +0800, haosdent wrote:
> > really should not assume ->d_inode stable
> 
> Hi, Alexander, sorry to disturb you again. Today I try to check what
> `dentry->d_inode` and `nd->link_inode` looks like when `dentry` is
> already been killed in `__dentry_kill`.
> 
> ```
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> nd->last.name: net/sockstat, dentry->d_lockref.count: -128,
> dentry->d_inode: (nil), nd->link_inode: 0xffffffffab299966
> ```
> 
> It looks like `dentry->d_inode` could be NULL while `nd->link_inode`
> is always has value.
> But this make me confuse, by right `nd->link_inode` is get from
> `dentry->d_inode`, right?

It's sampled from there, yes.  And in RCU mode there's nothing to
prevent a previously positive dentry from getting negative and/or
killed.  ->link_inode (used to - it's gone these days) go with
->seq, which had been sampled from dentry->d_seq before fetching
->d_inode and then verified to have ->d_seq remain unchanged.
That gives you "dentry used to have this inode at the time it
had this d_seq", and that's what gets used to validate the sucker
when we switch to non-RCU mode (look at legitimize_links()).

IOW, we know that
	* at some point during the pathwalk that sucker had this inode
	* the inode won't get freed until we drop out of RCU mode
	* if we need to go to non-RCU (and thus grab dentry references)
while we still need that inode, we will verify that nothing has happened
to that link (same ->d_seq, so it still refers to the same inode) and
grab dentry reference, making sure it won't go away or become negative
under us.  Or we'll fail (in case something _has_ happened to dentry)
and repeat the entire thing in non-RCU mode.