linux-kernel - io_uring / POLLFREE bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <_wc1nIgRG1zvW3080DQDu3PEJwSosUqccFhCNUZzKcawvz68icwFEtkSECxh18CTIRpbFN1gBhB74sfbVoGfJuDcczaQf25ePXNoh9DBg1o=@protonmail.com>
Date:   Sat, 19 Nov 2022 22:19:05 +0000
From:   Alexandre <roger.andersen@...tonmail.com>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: io_uring / POLLFREE bug

Hello,

I wanted (as an exercise) to dive into recent io_uring / POLLFREE pb and try to understand what really happens under the hood. I looked at this commit of yours : https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=linux-5.4.y&id=fc78b2fc21f10c4c9c4d5d659a685710ffa63659 and tried to investigate from there. Basically, I tried to produce the bug / trigger a crash with a small C code (using liburing) that creates a signalfd() and polls it with io_uring. I failed until now to understand what happens.

This is my understanding of the situation :
- "signalfd_wqh" is a queue created during task creation (kernel/fork.c:sighand_ctor())
- it is freed with kmem_cache_free() at task end (kernel/fork.c/__cleanup_sighand())
- before it is freed, there is a call to signalfd_cleanup() that sends a POLLFREE (kernel/fork.c/__cleanup_sighand())
- waiters are supposed to use this POLLFREE to stop polling and free resources, but io_uring does not do that 
- the bug is that : io_uring_poll (io_uring.c) calls signalfd_poll() using signalfd_wqh as its poll_table parameter, but it has been freed (poll_wait, should crash I suppose)
- since the task must be finished, we *MUST* use "kernel polled" mode, to allow kernel to continue polling after the memory was freed. Otherwise we can't trigger the bug, can we ?
- but then, why would kernel enter io_uring_poll after task was terminated ?

Thanks again and keep up the good work