From patchwork Sun Mar 5 19:18:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Al Viro X-Patchwork-Id: 9604759 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 04B52602B4 for ; Sun, 5 Mar 2017 20:02:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EB24127F81 for ; Sun, 5 Mar 2017 20:02:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id DCB4527F8F; Sun, 5 Mar 2017 20:02:43 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 916E627F81 for ; Sun, 5 Mar 2017 20:02:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752463AbdCEUCZ (ORCPT ); Sun, 5 Mar 2017 15:02:25 -0500 Received: from zeniv.linux.org.uk ([195.92.253.2]:42620 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752383AbdCEUCY (ORCPT ); Sun, 5 Mar 2017 15:02:24 -0500 Received: from viro by ZenIV.linux.org.uk with local (Exim 4.87 #1 (Red Hat Linux)) id 1ckbfO-0007gZ-UJ; Sun, 05 Mar 2017 19:18:03 +0000 Date: Sun, 5 Mar 2017 19:18:02 +0000 From: Al Viro To: Dmitry Vyukov Cc: "linux-fsdevel@vger.kernel.org" , LKML , syzkaller Subject: Re: fs: use-after-free in path_lookupat Message-ID: <20170305191802.GK29622@ZenIV.linux.org.uk> References: <20170304193910.GG29622@ZenIV.linux.org.uk> <20170305155707.GI29622@ZenIV.linux.org.uk> <20170305163301.GJ29622@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.7.1 (2016-10-04) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP On Sun, Mar 05, 2017 at 06:33:18PM +0100, Dmitry Vyukov wrote: > Added more debug output. > > name_to_handle_at(r4, &(0x7f0000003000-0x6)="2e2f62757300", > &(0x7f0000003000-0xd)={0xc, 0x0, "cd21"}, &(0x7f0000002000)=0x0, > 0x1000) > > actually passes name="" because of the overlapping addresses. Flags > contain AT_EMPTY_PATH. Bloody hell... So you end up with name == (char *)&handle->handle_type + 3? Looks like it would be a lot more useful to dump the actual contents of those suckers right before the syscall... Anyway, that explains WTF is going on. The bug is in path_init() and it triggers when you pass something with dentry allocated by d_alloc_pseudo() as dfd, combined with empty pathname. You need to have the file closed by another thread, and have that another thread get out of closing syscall (close(), dup2(), etc.) before the caller of path_init() gets to complete_walk(). We need to make sure that this sucker gets DCACHE_RCUPDATE while it's still guaranteed to be pinned down. Could you try to reproduce with the patch below applied? diff --git a/fs/namei.c b/fs/namei.c index 6f7d96368734..70840281a41c 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -2226,11 +2226,16 @@ static const char *path_init(struct nameidata *nd, unsigned flags) nd->path = f.file->f_path; if (flags & LOOKUP_RCU) { rcu_read_lock(); - nd->inode = nd->path.dentry->d_inode; - nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq); + if (unlikely(!(dentry->d_flags & DCACHE_RCUACCESS))) { + spin_lock(&dentry->d_lock); + dentry->d_flags |= DCACHE_RCUACCESS; + spin_unlock(&dentry->d_lock); + } + nd->inode = dentry->d_inode; + nd->seq = read_seqcount_begin(&dentry->d_seq); } else { path_get(&nd->path); - nd->inode = nd->path.dentry->d_inode; + nd->inode = dentry->d_inode; } fdput(f); return s;