Messages in this thread | | | Date | Tue, 24 Jul 2018 14:54:21 +0900 | From | DaeRyong Jeong <> | Subject | Re: KASAN: use-after-free Read in link_path_walk |
| |
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title></title> </head> <body> <div name="messageBodySection">Because our fuzzer has a problem, I don't have a C reproducer so far.<br /> I reported the crash becasue I saw the crash repeatedly in our fuzzer and I hoped the report is helpful. But it seems not enough.<br /> If I was wrong and I made you confused, I am really sorry for that.<br /> Could you give me a second?<br /> I am trying to fix our fuzzer and to make a C reproducer.<br /> I think the C reproducer is necessary here.</div> <div name="messageReplySection">On 24 Jul 2018, 2:29 PM +0900, Al Viro <viro@zeniv.linux.org.uk>, wrote:<br /> <blockquote type="cite">On Tue, Jul 24, 2018 at 06:17:26AM +0100, Al Viro wrote:<br /> <blockquote type="cite">On Tue, Jul 24, 2018 at 12:45:42PM +0900, Dae R. Jeong wrote:<br /> <blockquote type="cite">Diagnosis:<br /> We think that it is possible that link_path_walk() dereferences a<br /> freed pointer when cleanup_mnt() is executed between path_init() and<br /> link_path_walk().<br /> <br /> Since I'm not an expert on a file system and don't fully understand<br /> the crash, please see a executed program and a crash log below in<br /> case that my understanding is wrong.<br /> <br /> <br /> Executed Program:<br /> Thread0 Thread1<br /> mkdir("./file0")<br /> |--------------------------|<br /> | mount("./file0", "./file0", "devpts", 0x0, "")<br /> | |<br /> openat(AT_FDCWD, chroot("./file0")<br /> "/dev/vcs", 0x200, 0x0) umount("./file0", 0x2)<br /> <br /> openat(), chroot(), umount() syscalls are executed after mount() syscall.<br /> We think a race occurs between openat() and chroot() because RaceFuzzer<br /> executed openat() and chroot() concurrently.<br /> <br /> <br /> (Possible) Thread interleaving:<br /> CPU0 (path_openat) CPU1 (cleanup_mnt)<br /></blockquote> </blockquote> <br /> Wait a bloody minute. Where does cleanup_mnt() come from in that thing?<br /> You are doing lazy-umount of the thing you've chrooted into; if it ends<br /> up with zero refcount on that mount, we are already in deep, deep trouble,<br /> races with open() on not. Simply following that with stat / (in thread 1,<br /> without thread0 at all) would end up accessing the same vfsmount. And<br /> if it's been freed, we are well and truly fucked, race or no race.<br /> <br /> I really want details. *Is* cleanup_mnt() called by thread 1 in your<br /> reproducer before the use-after-free hits? And what's the root of<br /> thread 0 at that point?<br /></blockquote> </div> </body> </html>
| |