Messages in this thread | | | From | Yu Zhao <> | Date | Mon, 4 Oct 2021 15:34:05 -0600 | Subject | Re: linux 5.14.3: free_user_ns causes NULL pointer dereference |
| |
On Mon, Oct 4, 2021 at 11:19 AM Eric W. Biederman <ebiederm@xmission.com> wrote: > > ebiederm@xmission.com (Eric W. Biederman) writes: > > > Adding Rune Kleveland to the discussion as he also seems to have > > reproduced the issue. > > > > Alex and I have been starring at the code and the reports and this > > bug is hiding well. Here is what we have figured out so far. > > > > Both the warning from free_user_ns calling dec_ucount that Jordan Glover > > reported and the KASAN error that Yu Zhao has reported appear to have > > the same cause. Using a ucounts structure after it has been freed and > > reallocated as something else. > > > > I have just skimmed through the recent report from Rune Kleveland > > and it appears also to be a use after free. Especially since the > > second failure in the log is slub complaining about trying to free > > the ucounts data structure. > > > > We looked through the users of put_ucounts and we don't see any obvious > > buggy users that would be freeing the data structure early. > > > > Alex has tried to reproduce this so far is not having any luck. > > Folks can you tell what compiler versions you are using and share your > > kernel config with us? That might help.
Thanks. Per your request:
$ aarch64-cros-linux-gnu-clang -v Chromium OS 12.0_pre422132_p20210405-r9 clang version 13.0.0 (/var/tmp/portage/sys-devel/llvm-12.0_pre422132_p20210405-r9/work/llvm-12.0_pre422132_p20210405/clang cd442157cff4aad209ae532cbf031abbe10bc1df) Target: aarch64-cros-linux-gnu Thread model: posix InstalledDir: /usr/bin Found candidate GCC installation: /usr/bin/../lib/gcc/aarch64-cros-linux-gnu/10.2.0 Found candidate GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Selected GCC installation: /usr/bin/../lib64/gcc/aarch64-cros-linux-gnu/10.2.0 Candidate multilib: .;@m64 Selected multilib: .;@m64
Kernel config attached. [unhandled content-type:application/octet-stream] | |