| Message ID | CACT4Y+ZHgE2r9fGsDS_7CHsxa53yrsx0Zp0TBvH4oeqg24w5Yg@mail.gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > I am pretty sure it is that one. > I don't think I ever used name_to_handle_at syscall in my life and I > definitely didn't make it lookup a memfd :) So what does it normally return? On the runs where we do not hit that use-after-free, that is. What gets triggered there is nd->path.dentry pointing to already freed dentry. We are in RCU mode, so we are not pinning the dentry and it might have reached dentry_free(). However, anything with DCACHE_RCUACCESS set would have freeing RCU-delayed, making that impossible. memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it plausible, but... there we really should've been stopped cold by the d_can_lookup() check - that is done while we are still holding a reference to struct file, which should've prevented freeing and reuse. So at the time of that check we have dentry still not reused by anything, and d_can_lookup() should've failed. There is a race that could bugger the things up in that area, but it needs empty name, so this one is something else...
On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > >> I am pretty sure it is that one. >> I don't think I ever used name_to_handle_at syscall in my life and I >> definitely didn't make it lookup a memfd :) > > So what does it normally return? On the runs where we do not hit that > use-after-free, that is. > > What gets triggered there is nd->path.dentry pointing to already freed > dentry. We are in RCU mode, so we are not pinning the dentry and it > might have reached dentry_free(). However, anything with DCACHE_RCUACCESS > set would have freeing RCU-delayed, making that impossible. > > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it > plausible, but... there we really should've been stopped cold by > the d_can_lookup() check - that is done while we are still holding > a reference to struct file, which should've prevented freeing and > reuse. So at the time of that check we have dentry still not reused > by anything, and d_can_lookup() should've failed. > > There is a race that could bugger the things up in that area, but it needs > empty name, so this one is something else... You can see from the log above that s always empty somehow, so the d_can_lookup check is simply not done. I have not looked at the code, but it's not racy, so should follow from the arguments passed to name_to_handle_at.
On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: > On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: > > > >> I am pretty sure it is that one. > >> I don't think I ever used name_to_handle_at syscall in my life and I > >> definitely didn't make it lookup a memfd :) > > > > So what does it normally return? On the runs where we do not hit that > > use-after-free, that is. > > > > What gets triggered there is nd->path.dentry pointing to already freed > > dentry. We are in RCU mode, so we are not pinning the dentry and it > > might have reached dentry_free(). However, anything with DCACHE_RCUACCESS > > set would have freeing RCU-delayed, making that impossible. > > > > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it > > plausible, but... there we really should've been stopped cold by > > the d_can_lookup() check - that is done while we are still holding > > a reference to struct file, which should've prevented freeing and > > reuse. So at the time of that check we have dentry still not reused > > by anything, and d_can_lookup() should've failed. > > > > There is a race that could bugger the things up in that area, but it needs > > empty name, so this one is something else... > > You can see from the log above that s always empty somehow, so the > d_can_lookup check is simply not done. I have not looked at the code, > but it's not racy, so should follow from the arguments passed to > name_to_handle_at. Umm... name_to_handle_at() in your log: name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000) and unless I'm misreading what you are printing there, you have "./bus0" passed as the second argument. Right? That's pretty much why I asked about other possible calls triggering it... If you are somehow getting there with empty name and if there's another thread closing these memfd descriptors, I understand what's going on there. It's how we are getting that empty name on your syscall arguments that looks very odd...
On Sun, Mar 5, 2017 at 5:33 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: > On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: >> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: >> > >> >> I am pretty sure it is that one. >> >> I don't think I ever used name_to_handle_at syscall in my life and I >> >> definitely didn't make it lookup a memfd :) >> > >> > So what does it normally return? On the runs where we do not hit that >> > use-after-free, that is. >> > >> > What gets triggered there is nd->path.dentry pointing to already freed >> > dentry. We are in RCU mode, so we are not pinning the dentry and it >> > might have reached dentry_free(). However, anything with DCACHE_RCUACCESS >> > set would have freeing RCU-delayed, making that impossible. >> > >> > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it >> > plausible, but... there we really should've been stopped cold by >> > the d_can_lookup() check - that is done while we are still holding >> > a reference to struct file, which should've prevented freeing and >> > reuse. So at the time of that check we have dentry still not reused >> > by anything, and d_can_lookup() should've failed. >> > >> > There is a race that could bugger the things up in that area, but it needs >> > empty name, so this one is something else... >> >> You can see from the log above that s always empty somehow, so the >> d_can_lookup check is simply not done. I have not looked at the code, >> but it's not racy, so should follow from the arguments passed to >> name_to_handle_at. > > Umm... name_to_handle_at() in your log: > name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000) > and unless I'm misreading what you are printing there, you have "./bus0" > passed as the second argument. Right? That's pretty much why I asked about > other possible calls triggering it... > > If you are somehow getting there with empty name and if there's another > thread closing these memfd descriptors, I understand what's going on there. > It's how we are getting that empty name on your syscall arguments that > looks very odd... Added more debug output. name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000) actually passes name="" because of the overlapping addresses. Flags contain AT_EMPTY_PATH.
On Sun, Mar 5, 2017 at 6:33 PM, Dmitry Vyukov <dvyukov@google.com> wrote: > On Sun, Mar 5, 2017 at 5:33 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >> On Sun, Mar 05, 2017 at 05:14:23PM +0100, Dmitry Vyukov wrote: >>> On Sun, Mar 5, 2017 at 4:57 PM, Al Viro <viro@zeniv.linux.org.uk> wrote: >>> > On Sun, Mar 05, 2017 at 12:37:13PM +0100, Dmitry Vyukov wrote: >>> > >>> >> I am pretty sure it is that one. >>> >> I don't think I ever used name_to_handle_at syscall in my life and I >>> >> definitely didn't make it lookup a memfd :) >>> > >>> > So what does it normally return? On the runs where we do not hit that >>> > use-after-free, that is. >>> > >>> > What gets triggered there is nd->path.dentry pointing to already freed >>> > dentry. We are in RCU mode, so we are not pinning the dentry and it >>> > might have reached dentry_free(). However, anything with DCACHE_RCUACCESS >>> > set would have freeing RCU-delayed, making that impossible. >>> > >>> > memfd stuff does *not* have DCACHE_RCUACCESS, which would've made it >>> > plausible, but... there we really should've been stopped cold by >>> > the d_can_lookup() check - that is done while we are still holding >>> > a reference to struct file, which should've prevented freeing and >>> > reuse. So at the time of that check we have dentry still not reused >>> > by anything, and d_can_lookup() should've failed. >>> > >>> > There is a race that could bugger the things up in that area, but it needs >>> > empty name, so this one is something else... >>> >>> You can see from the log above that s always empty somehow, so the >>> d_can_lookup check is simply not done. I have not looked at the code, >>> but it's not racy, so should follow from the arguments passed to >>> name_to_handle_at. >> >> Umm... name_to_handle_at() in your log: >> name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, 0x1000) >> and unless I'm misreading what you are printing there, you have "./bus0" >> passed as the second argument. Right? That's pretty much why I asked about >> other possible calls triggering it... >> >> If you are somehow getting there with empty name and if there's another >> thread closing these memfd descriptors, I understand what's going on there. >> It's how we are getting that empty name on your syscall arguments that >> looks very odd... > > > Added more debug output. > > name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", > &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, > 0x1000) > > actually passes name="" because of the overlapping addresses. Flags > contain AT_EMPTY_PATH. The problem can be more general as a bunch of xxxat calls support AT_EMPTY_PATH.
--- a/fs/namei.c +++ b/fs/namei.c @@ -2213,6 +2213,7 @@ static const char *path_init(struct nameidata *nd, unsigned flags) dentry = f.file->f_path.dentry; +pr_err("%d: path_init: s=%s flags=%d\n", current->pid, s, dentry->d_flags); if (*s) { if (!d_can_lookup(dentry)) {