lkml.org 
[lkml]   [2018]   [Jul]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: KASAN: use-after-free Read in link_path_walk
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection">Because our fuzzer has a problem, I don't have a C reproducer so far.<br />
I reported the crash becasue I saw the crash repeatedly in our fuzzer and I hoped the report is helpful. But it seems not enough.<br />
If I was wrong and I made you confused, I am really sorry for that.<br />
Could you give me a second?<br />
I am trying to fix our fuzzer and to make a C reproducer.<br />
I think the C reproducer is necessary here.</div>
<div name="messageReplySection">On 24 Jul 2018, 2:29 PM +0900, Al Viro &lt;viro@zeniv.linux.org.uk&gt;, wrote:<br />
<blockquote type="cite">On Tue, Jul 24, 2018 at 06:17:26AM +0100, Al Viro wrote:<br />
<blockquote type="cite">On Tue, Jul 24, 2018 at 12:45:42PM +0900, Dae R. Jeong wrote:<br />
<blockquote type="cite">Diagnosis:<br />
We think that it is possible that link_path_walk() dereferences a<br />
freed pointer when cleanup_mnt() is executed between path_init() and<br />
link_path_walk().<br />
<br />
Since I'm not an expert on a file system and don't fully understand<br />
the crash, please see a executed program and a crash log below in<br />
case that my understanding is wrong.<br />
<br />
<br />
Executed Program:<br />
Thread0 Thread1<br />
mkdir("./file0")<br />
|--------------------------|<br />
| mount("./file0", "./file0", "devpts", 0x0, "")<br />
| |<br />
openat(AT_FDCWD, chroot("./file0")<br />
"/dev/vcs", 0x200, 0x0) umount("./file0", 0x2)<br />
<br />
openat(), chroot(), umount() syscalls are executed after mount() syscall.<br />
We think a race occurs between openat() and chroot() because RaceFuzzer<br />
executed openat() and chroot() concurrently.<br />
<br />
<br />
(Possible) Thread interleaving:<br />
CPU0 (path_openat) CPU1 (cleanup_mnt)<br /></blockquote>
</blockquote>
<br />
Wait a bloody minute. Where does cleanup_mnt() come from in that thing?<br />
You are doing lazy-umount of the thing you've chrooted into; if it ends<br />
up with zero refcount on that mount, we are already in deep, deep trouble,<br />
races with open() on not. Simply following that with stat / (in thread 1,<br />
without thread0 at all) would end up accessing the same vfsmount. And<br />
if it's been freed, we are well and truly fucked, race or no race.<br />
<br />
I really want details. *Is* cleanup_mnt() called by thread 1 in your<br />
reproducer before the use-after-free hits? And what's the root of<br />
thread 0 at that point?<br /></blockquote>
</div>
</body>
</html>
\
 
 \ /
  Last update: 2018-07-24 07:56    [W:0.163 / U:0.284 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site