lkml.org 
[lkml]   [2017]   [Aug]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 41/84] fork: fix incorrect fput of ->exe_file causing use-after-free
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit 2b7e8665b4ff51c034c55df3cff76518d1a9ee3a upstream.

    Commit 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for
    write killable") made it possible to kill a forking task while it is
    waiting to acquire its ->mmap_sem for write, in dup_mmap().

    However, it was overlooked that this introduced an new error path before
    a reference is taken on the mm_struct's ->exe_file. Since the
    ->exe_file of the new mm_struct was already set to the old ->exe_file by
    the memcpy() in dup_mm(), it was possible for the mmput() in the error
    path of dup_mm() to drop a reference to ->exe_file which was never
    taken.

    This caused the struct file to later be freed prematurely.

    Fix it by updating mm_init() to NULL out the ->exe_file, in the same
    place it clears other things like the list of mmaps.

    This bug was found by syzkaller. It can be reproduced using the
    following C program:

    #define _GNU_SOURCE
    #include <pthread.h>
    #include <stdlib.h>
    #include <sys/mman.h>
    #include <sys/syscall.h>
    #include <sys/wait.h>
    #include <unistd.h>

    static void *mmap_thread(void *_arg)
    {
    for (;;) {
    mmap(NULL, 0x1000000, PROT_READ,
    MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
    }
    }

    static void *fork_thread(void *_arg)
    {
    usleep(rand() % 10000);
    fork();
    }

    int main(void)
    {
    fork();
    fork();
    fork();
    for (;;) {
    if (fork() == 0) {
    pthread_t t;

    pthread_create(&t, NULL, mmap_thread, NULL);
    pthread_create(&t, NULL, fork_thread, NULL);
    usleep(rand() % 10000);
    syscall(__NR_exit_group, 0);
    }
    wait(NULL);
    }
    }

    No special kernel config options are needed. It usually causes a NULL
    pointer dereference in __remove_shared_vm_struct() during exit, or in
    dup_mmap() (which is usually inlined into copy_process()) during fork.
    Both are due to a vm_area_struct's ->vm_file being used after it's
    already been freed.

    Google Bug Id: 64772007

    Link: http://lkml.kernel.org/r/20170823211408.31198-1-ebiggers3@gmail.com
    Fixes: 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for write killable")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Tested-by: Mark Rutland <mark.rutland@arm.com>
    Acked-by: Michal Hocko <mhocko@suse.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/fork.c | 1 +
    1 file changed, 1 insertion(+)

    --- a/kernel/fork.c
    +++ b/kernel/fork.c
    @@ -766,6 +766,7 @@ static struct mm_struct *mm_init(struct
    mm_init_cpumask(mm);
    mm_init_aio(mm);
    mm_init_owner(mm, p);
    + RCU_INIT_POINTER(mm->exe_file, NULL);
    mmu_notifier_mm_init(mm);
    clear_tlb_flush_pending(mm);
    #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && !USE_SPLIT_PMD_PTLOCKS

    \
     
     \ /
      Last update: 2017-08-28 10:54    [W:4.110 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site