lkml.org 
[lkml]   [2012]   [Mar]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [3.3-rc7] sys_poll use after free (hibernate)
    On Mon, Mar 12, 2012 at 5:58 PM, Dave Jones <davej@redhat.com> wrote:
    >
    > While trying to reproduce the i915 memory corruption problem with hibernate,
    > I've hit the following use-after-free quite a few times, by running my
    > syscall fuzzer and hibernating/resuming in a loop.
    >
    > oops below on 3.3rc7, but same problem also affects 3.2.9, and probably
    > many versions before that.
    >
    > RIP: proc_sys_poll+0x4e/0x90
    > Code: 00 48 89 fb 48 89 f1 48 8b 40 30 4c 8b 60 e8 b8 45 01 00 00 49 83 7c 24 28 00 74 2e 49 8b 74 24 30 48 85 f6 74 24 48 85 c9 75 32 <8b> 16 b8 45 01 00 00 48 63 d2 49 39 d5 74 10 8b 06 48 98 48 89

    The code is:

    0: 48 89 fb mov %rdi,%rbx
    3: 48 89 f1 mov %rsi,%rcx
    6: 48 8b 40 30 mov 0x30(%rax),%rax
    a: 4c 8b 60 e8 mov -0x18(%rax),%r12
    e: b8 45 01 00 00 mov $0x145,%eax
    13: 49 83 7c 24 28 00 cmpq $0x0,0x28(%r12)
    19: 74 2e je 0x49
    1b: 49 8b 74 24 30 mov 0x30(%r12),%rsi
    20: 48 85 f6 test %rsi,%rsi
    23: 74 24 je 0x49
    25: 48 85 c9 test %rcx,%rcx
    28: 75 32 jne 0x5c
    2a:* 8b 16 mov (%rsi),%edx <-- trapping instruction
    2c: b8 45 01 00 00 mov $0x145,%eax
    31: 48 63 d2 movslq %edx,%rdx
    34: 49 39 d5 cmp %rdx,%r13
    37: 74 10 je 0x49
    39: 8b 06 mov (%rsi),%eax

    and that load is from

    poll_wait(filp, &table->poll->wait, wait);

    where the testing of %rsi and %rcx are the "if (p && wait_address)"
    check in poll_wait(), and %rsi is "table->poll" if I read it all
    correctly.

    And the 6b6b6b6b6b6b6b6b pattern is obviously POISON_FREE, so
    apparently 'table' has already been freed.

    I suspect the whole sysctl 'poll' code is seriously broken, since it
    seems to depend on those ctl_table pointers being stable over the
    whole open/close sequence, but if somebody unregisters the sysctl,
    it's all gone. The ctl_table doesn't have any refcounting etc, and I
    suspect that your hibernate sequence ends up unregistering some sysctl
    (perhaps as part of a module unload?)

    The sysctl poll code was added fairly recently, I'm adding the guilty
    parties and some other relevant people to the cc.

    Oh, how I hate sysctl's. Misdesigned from the start.

    Linus


    \
     
     \ /
      Last update: 2012-03-18 20:05    [W:0.020 / U:58.724 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site