linux-kernel - Re: linux 5.14.3: free_user_ns causes NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87zgsb5gaq.fsf@disp2133>
Date:   Fri, 17 Sep 2021 11:15:57 -0500
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Yu Zhao <yuzhao@...gle.com>
Cc:     Jordan Glover <Golden_Miller83@...tonmail.ch>,
        LKML <linux-kernel@...r.kernel.org>,
        "linux-mm\@kvack.org" <linux-mm@...ck.org>,
        "legion\@kernel.org" <legion@...nel.org>,
        "containers\@lists.linux-foundation.org" 
        <containers@...ts.linux-foundation.org>
Subject: Re: linux 5.14.3: free_user_ns causes NULL pointer dereference

Yu Zhao <yuzhao@...gle.com> writes:

> On Wed, Sep 15, 2021 at 4:42 PM Jordan Glover
> <Golden_Miller83@...tonmail.ch> wrote:
>>
>> On Wednesday, September 15th, 2021 at 9:02 PM, <ebiederm@...ssion.com> wrote:
>>
>> > Jordan Glover Golden_Miller83@...tonmail.ch writes:
>> >
>> > > Hi, recently I hit system freeze after I was closing few containerized apps on my system. As for now it occurred only once on linux 5.14.3. I think it maybe be related to "Count rlimits in each user namespace" patchset merged during 5.14 window
>> > >
>> > > https://lore.kernel.org/all/257aa5fb1a7d81cf0f4c34f39ada2320c4284771.1619094428.git.legion@kernel.org/T/#u
>> >
>> > So that warning comes from:
>> >
>> > void dec_ucount(struct ucounts *ucounts, enum ucount_type type)
>> >
>> > {
>> >
>> > struct ucounts *iter;
>> >
>> > for (iter = ucounts; iter; iter = iter->ns->ucounts) {
>> >
>> >       long dec = atomic_long_dec_if_positive(&iter->ucount[type]);
>> >
>> >       WARN_ON_ONCE(dec < 0);
>> >     }
>> >     put_ucounts(ucounts);
>> >
>> >
>> > }
>> >
>> > Which certainly looks like a reference count bug. It could also be a
>> >
>> > memory stomp somewhere close.
>> >
>> > Do you have any idea what else was going on? This location is the
>> >
>> > symptom but not the actual cause.
>> >
>> > Eric
>>
>> I had about 2 containerized (flatpak/bubblewrap) apps (browser + music player) running . I quickly closed them with intent to shutdown the system but instead get the freeze and had to use magic sysrq to reboot. System logs end with what I posted and before there is nothing suspicious.
>>
>> Maybe it's some random fluke. I'll reply if I hit it again.
>
> I have been able to steadily reproduce this for a while. But I haven't
> had time to look into it. I'd appreciate any help.

It would be very helpful if you could look farther back in your logs and
see if you can also see:
WARNING: CPU: 1 PID: 351 at kernel/ucount.c:253 dec_ucount+0x43/0x5

Or anything else preceding the use-after-free.

I am inclined to think they are the same issue but without seeing the
WARN_ON_ONCE I can't safely conclude that.

Eric