From patchwork Fri Oct 16 23:09:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jann Horn X-Patchwork-Id: 11842439 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3C2061580 for ; Fri, 16 Oct 2020 23:09:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CD54922227 for ; Fri, 16 Oct 2020 23:09:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Xm1tybRY" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CD54922227 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D6F0F6B005D; Fri, 16 Oct 2020 19:09:37 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id D206B6B0062; Fri, 16 Oct 2020 19:09:37 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C0F7A6B0068; Fri, 16 Oct 2020 19:09:37 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 85DE46B005D for ; Fri, 16 Oct 2020 19:09:37 -0400 (EDT) Received: from smtpin26.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 15D161EE6 for ; Fri, 16 Oct 2020 23:09:37 +0000 (UTC) X-FDA: 77379332394.26.join29_560d0d927220 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin26.hostedemail.com (Postfix) with ESMTP id D9EDB1804B655 for ; Fri, 16 Oct 2020 23:09:36 +0000 (UTC) X-Spam-Summary: 1,0,0,73cd7d4a6439fc52,d41d8cd98f00b204,jannh@google.com,,RULES_HIT:41:69:355:379:541:965:966:968:973:982:988:989:1260:1311:1314:1345:1437:1513:1515:1521:1535:1543:1605:1711:1730:1747:1777:1792:2196:2199:2393:2559:2562:2892:2894:2901:3138:3139:3140:3141:3142:3152:3865:3866:3867:3868:3870:3871:3872:3874:4117:4250:4321:4385:4390:4395:4605:5007:6117:6119:6120:6261:6653:7875:7901:7903:9010:9969:10004:11026:11658:11914:12043:12048:12266:12296:12297:12438:12517:12519:12555:12679:12683:12895:12986:13161:13229:14096:14721:21080:21365:21433:21444:21451:21627:21740:21809:21939:30054:30056:30070:30075,0,RBL:209.85.128.68:@google.com:.lbl8.mailshell.net-62.18.0.100 66.100.201.100;04y8sy46qktcrg9sy9h53ma36ynarop1kbaurh6fyf8rtzf7f6hht5wpiyjc9d6.asdtq9c868kuwux46hzhnpko6jnnrbtdi1gkzsb3yg63pj3bjfh6yuaprzadia1.r-lbl8.mailshell.net-223.238.255.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:24, LUA_SUMM X-HE-Tag: join29_560d0d927220 X-Filterd-Recvd-Size: 6392 Received: from mail-wm1-f68.google.com (mail-wm1-f68.google.com [209.85.128.68]) by imf13.hostedemail.com (Postfix) with ESMTP for ; Fri, 16 Oct 2020 23:09:36 +0000 (UTC) Received: by mail-wm1-f68.google.com with SMTP id j136so4669576wmj.2 for ; Fri, 16 Oct 2020 16:09:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jTe2yM9MxVhTrRdmKwL9Wwkl5X/2QK8pL2bJ3R7EOUI=; b=Xm1tybRYP076OiQR+/pHfTWF1G+ibHMTo4J+kOVzkkLTFFwHVvKepGLA7Tqum0TilH Le9ss7vtK3Gy6C1mpCA2Ypfp2Bu7K2/3FKf6MT5b01WXADL/QnsjPiIN+3FzAFh2T73e OrSCGyetLSK+1mjRKcXHRd8xZf6Eoe2JVuvBSqUHx7ZN4sTWSmkPUNAp1grXXPlSrq9+ bOeORmET7UNEhsfUwmhAxZa8UC1gujD0bKWgc7gR55cL/b9x9oDJI0COrUMxq3cGaixY 2hWJZTqnaq15Z88hUuyIKKe9xkukjrJl8TEJJsTGSNdvO/AJMACjzpF2YRutg1jUaL5G JQzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=jTe2yM9MxVhTrRdmKwL9Wwkl5X/2QK8pL2bJ3R7EOUI=; b=qZIQyYbnpSfNiHId00h7JhmBHq6/HI6shyxTRr19twLiZArJFWqe/VXh2TlXGh1NfR sgVCwe4X8H4pK4PRSQbtRDSnBnWgQFb+eVtJliekwzxhKLJ5RXm2YQGbSTFzT1PVizee qvTuiq7LrGnLnQPQOWIzwAUOtjWlBOCVwC3lg2nWXQjtm511gMSKZKedgOSMk90pya6n rq5SHk8OT+faklw/ekKbORuAxK2SR3d7cOWvovCR1GxPCeBM5bWzWc89bMJD0STVED5r mdjZQ9XHdCXZ7MGm3UUTp/5eCfEC9m1XonuS1P+ojKiU9hacX/le+OWReAYpV73rAjy6 jB0w== X-Gm-Message-State: AOAM533JVA6aeiMg9LDQUPYuUl/5K4JhcxStJDAoL4luxkou2XFUVSPY 6nQuJzpBS4RkzVIh4ty0AnZ65A== X-Google-Smtp-Source: ABdhPJyHb3io1WzS7Ad+62Dhh+ev7B30uujM+fePi4lCBeDT31mPCbn8zrbgi/huCJBRUvhDMIxiow== X-Received: by 2002:a1c:152:: with SMTP id 79mr5954225wmb.60.1602889775091; Fri, 16 Oct 2020 16:09:35 -0700 (PDT) Received: from localhost ([2a02:168:96c5:1:55ed:514f:6ad7:5bcc]) by smtp.gmail.com with ESMTPSA id v4sm4504518wmg.35.2020.10.16.16.09.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 16 Oct 2020 16:09:33 -0700 (PDT) From: Jann Horn To: Andrew Morton , linux-mm@kvack.org, Eric Biederman , Oleg Nesterov Cc: linux-kernel@vger.kernel.org, Will Deacon , Kees Cook , Ingo Molnar Subject: [RFC PATCH resend 0/6] mm and ptrace: Track dumpability until task is freed Date: Sat, 17 Oct 2020 01:09:09 +0200 Message-Id: <20201016230915.1972840-1-jannh@google.com> X-Mailer: git-send-email 2.29.0.rc1.297.gfa9743e501-goog MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: [sorry, had to resend - it was pointed out to me that when I sent this series the first time, DKIM got broken by the kvack list rewriting 8-bit into quoted-printable] At the moment, there is a lifetime issue (no, not the UAF kind) around __ptrace_may_access(): __ptrace_may_access() wants to check mm->flags and mm->user_ns to figure out whether the caller should be allowed to access some target task. __ptrace_may_access() can be called as long as __put_task_struct() hasn't happened yet; but __put_task_struct() happens when the task is about to be freed, which is much later than exit_mm() (which happens pretty early during task exit). So we can have a situation where we need to consult the mm for a security check, but we don't have an mm anymore. At the moment, this is solved by failing open: If the mm is gone, we pretend that it was dumpable. That's dubious from a security perspective - as one example, we drop the mm_struct before the file descriptor table, so someone might be able to steal file descriptors from an exiting tasks when dumpability was supposed to prevent that. The easy fix would be to let __ptrace_may_access() instead always refuse access to tasks that have lost their mm; but then that would e.g. mean that the ability to inspect dead tasks in procfs would be restricted. So while that might work in practice, it'd be a bit ugly, too. Another option would be to move the dumpability information elsewhere - but that would have to be the task_struct (the signal_struct can be shared with dead pre-execve threads, so we can't use it here). So we'd have to keep dumpability information in sync across threads - that'd probably be pretty ugly. So I think the proper fix is to let the task_struct hold a reference on the mm_struct until the task goes away completely. This is implemented in patch 1/6, which is also the only patch in this series that I actually care about (and the only one with a stable backport marking); the rest of the series are some tweaks in case people dislike the idea of constantly freeing mm_structs from workqueue context. Those tweaks should also reduce the memory usage of dead tasks, by ensuring that they don't keep their PGDs alive. Patch 1/6 is not particularly pretty, but I can't think of any better way to do it. So: Does this series (and in particular patch 1/6) look vaguely sane? And if not, does anyone have a better approach? Jann Horn (6): ptrace: Keep mm around after exit_mm() for __ptrace_may_access() refcount: Move refcount_t definition into linux/types.h mm: Add refcount for preserving mm_struct without pgd mm, oom: Use mm_ref()/mm_unref() and avoid mmdrop_async() ptrace: Use mm_ref() for ->exit_mm mm: remove now-unused mmdrop_async() arch/x86/kernel/tboot.c | 2 + drivers/firmware/efi/efi.c | 2 + include/linux/mm_types.h | 15 ++++++- include/linux/refcount.h | 13 +----- include/linux/sched.h | 8 ++++ include/linux/sched/mm.h | 13 ++++++ include/linux/types.h | 12 +++++ kernel/exit.c | 2 + kernel/fork.c | 90 +++++++++++++++++--------------------- kernel/ptrace.c | 10 +++++ mm/init-mm.c | 2 + mm/oom_kill.c | 2 +- 12 files changed, 105 insertions(+), 66 deletions(-) base-commit: bbf5c979011a099af5dc76498918ed7df445635b