lkml.org 
[lkml]   [2011]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: Invalid credentials ( __validate_creds()) due to cred->magic == "DeaD" from sys_clone() (2.6.39 PREEMPT SMP SELinux kernel)
From
Another BUG(), a quite obvious use-after-free - still trying to create
a reproductible testcase.


=== KDB ===
Stack traceback for pid 28120
0xffff8800cba32ee0 28120 15501 1 1 R 0xffff8800cba33360 *iknowthis
<c> ffff8800cba3dea8<c> 0000000000000018<c> ffffffff810b6f16<c>
ffff880000000104<c>
<c> ffffffff8267436f<c> ffff88010367bf00<c> ffff88010367bf00<c>
ffff8800cba3def8<c>
<c> ffffffff810b6f48<c> ffff880000000104<c> ffffffff8267436f<c>
ffff8800cba3def8<c>
Call Trace:
[<ffffffff810b6f16>] ? __invalid_creds+0x53/0x55
[<ffffffff810b6f48>] ? __validate_creds+0x30/0x37
[<ffffffff810b6fa2>] ? put_cred+0x22/0x3a
[<ffffffff810b7463>] ? commit_creds+0x1d3/0x1de
[<ffffffff810a8ea4>] ? sys_setgid+0x75/0x8d
[<ffffffff81edab82>] ? system_call_fastpath+0x16/0x1b

[1]kdb> summary
sysname Linux
release 2.6.39
version #3 SMP PREEMPT Fri May 27 15:27:03 CEST 2011
machine x86_64
nodename ise-test
domainname (none)
ccversion CCVERSION
date 2011-06-07 01:56:05 tz_minuteswest -120
uptime 13:11
load avg 14.40 14.63 16.68

MemTotal: 993059 kB
MemFree: 485955 kB
Buffers: 20849 kB

DMESG:
<3>[47480.305640] CRED: Invalid credentials
<3>[47480.315628] CRED: At include/linux/cred.h:260
<3>[47480.320595] CRED: Specified credentials: ffff88010367bf00
<3>[47480.326668] CRED: ->magic=6b6b6b6b, put_addr=6b6b6b6b6b6b6b6b
<3>[47480.333593] CRED: ->usage=1802201963, subscr=1802201963
<3>[47480.339812] CRED: ->*uid = { 1802201963,1802201963,1802201963,1802201963 }
<3>[47480.347490] CRED: ->*gid = { 1802201963,1802201963,1802201963,1802201963 }
<3>[47480.354947] CRED: ->security is 6b6b6b6b6b6b6b6b

=== KGDB ===
(gdb) bt
#0 __invalid_creds (cred=0xffff88010367bf00, file=<value optimized
out>, line=<value optimized out>)
at kernel/cred.c:812
#1 0xffffffff810b6f48 in __validate_creds (cred=0xffff88010367bf00,
file=<value optimized out>,
line=<value optimized out>) at include/linux/cred.h:186
#2 0xffffffff810b6fa2 in put_cred (_cred=<value optimized out>) at
include/linux/cred.h:260
#3 0xffffffff810b7463 in commit_creds (new=0xffff88011aeda200) at
kernel/cred.c:540
#4 0xffffffff810a8ea4 in sys_setgid (gid=65534) at kernel/sys.c:577
#5 <signal handler called>
#6 0x00007ff2b4b78649 in __brk_reservation_fn_dmi_alloc__ ()
#7 0xffff880118cd1770 in __brk_reservation_fn_dmi_alloc__ ()
#8 0xffffffff82a1bed0 in ?? ()
#9 0x0000000200020000 in __brk_reservation_fn_dmi_alloc__ ()
#10 0x0000000300000000 in __brk_reservation_fn_dmi_alloc__ ()
#11 0x00007ffffffff000 in __brk_reservation_fn_dmi_alloc__ ()
#12 0xffffffff810a7406 in sys_restart_syscall () at kernel/signal.c:2085
#13 0x0000000000000000 in ?? ()

[4 frames up]

#4 0xffffffff810a8ea4 in sys_setgid (gid=65534) at kernel/sys.c:577
577 return commit_creds(new);

(gdb) p *old
$1 = {usage = {counter = 1802201963}, subscribers = {counter =
1802201963}, put_addr = 0x6b6b6b6b6b6b6b6b,
magic = 1802201963, uid = 1802201963, gid = 1802201963, suid =
1802201963, sgid = 1802201963, euid = 1802201963,
egid = 1802201963, fsuid = 1802201963, fsgid = 1802201963,
securebits = 1802201963, cap_inheritable = {cap = {
1802201963, 1802201963}}, cap_permitted = {cap = {1802201963,
1802201963}}, cap_effective = {cap = {1802201963,
1802201963}}, cap_bset = {cap = {1802201963, 1802201963}},
jit_keyring = 107 'k',
thread_keyring = 0x6b6b6b6b6b6b6b6b, request_key_auth =
0x6b6b6b6b6b6b6b6b, tgcred = 0x6b6b6b6b6b6b6b6b,
security = 0x6b6b6b6b6b6b6b6b, user = 0x6b6b6b6b6b6b6b6b, user_ns =
0x6b6b6b6b6b6b6b6b,
group_info = 0x6b6b6b6b6b6b6b6b, rcu = {next = 0x6b6b6b6b6b6b6b6b,
func = 0xa56b6b6b6b6b6b6b}}


(gdb) p *new
$2 = {usage = {counter = 2}, subscribers = {counter = 2}, put_addr =
0x0, magic = 1131636068, uid = 65534,
gid = 65534, suid = 65534, sgid = 65534, euid = 65534, egid = 65534,
fsuid = 65534, fsgid = 65534, securebits = 0,
cap_inheritable = {cap = {0, 0}}, cap_permitted = {cap = {0, 0}},
cap_effective = {cap = {0, 0}}, cap_bset = {cap = {
4294967295, 4294967295}}, jit_keyring = 0 '\000', thread_keyring
= 0x0, request_key_auth = 0x0,
tgcred = 0xffff880101adce58, security = 0xffff8801146fb340, user =
0xffff88011fcc7240, user_ns = 0xffffffff82a21a80,
group_info = 0xffff8800cb9fa000, rcu = {next = 0x0, func = 0}}


--
Robert Święcki
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2011-06-07 16:29    [W:0.101 / U:0.152 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site