LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: Brian Pomerantz <bapper@piratehaven.org>
Cc: viro@zeniv.linux.org.uk, linux-kernel@vger.kernel.org,
	Nick Piggin <nickpiggin@yahoo.com.au>,
	Hugh Dickins <hugh@veritas.com>
Subject: Re: [PATCH] fix page leak during core dump
Date: Fri, 30 Mar 2007 13:43:59 -0700	[thread overview]
Message-ID: <20070330134359.ec6d95bc.akpm@linux-foundation.org> (raw)
In-Reply-To: <20070329203913.GA5190@skull.piratehaven.org>

On Thu, 29 Mar 2007 13:39:13 -0700
Brian Pomerantz <bapper@piratehaven.org> wrote:

> When the dump cannot occur most likely because of a full file system
> and the page to be written is the zero page, the call to
> page_cache_release() is missed.
> 
> Signed-off-by: Brian Pomerantz <bapper@mvista.com>
> 
> diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
> index a2fceba..9cc4f0a 100644
> --- a/fs/binfmt_elf.c
> +++ b/fs/binfmt_elf.c
> @@ -1704,7 +1704,10 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file)
>  				DUMP_SEEK(PAGE_SIZE);
>  			} else {
>  				if (page == ZERO_PAGE(addr)) {
> -					DUMP_SEEK(PAGE_SIZE);
> +					if (!dump_seek(file, PAGE_SIZE)) {
> +						page_cache_release(page);
> +						goto end_coredump;
> +					}

Oh for gawds sake I wish we could be rid of those idiotic macros :(

This patch looks OK to me, although a refcount leak on the ZERO_PAGE is
special, because that page is PageReserved().

It used to be the case that we'd ignore attempts to change the refcount on
reserved pages (or at least on the ZERO_PAGE), but we changed that, so we
now actually refcount the ZERO_PAGE.  (I think, from a quick read of the
code.  This contradicts my memory of how it works).

So I expect the net effect here is that a sufficiently determined attacker
can overflow the ZERO_PAGE's refcount, thus causing it to be "freed".  The
page allocator won't actually free the page due to PG_Reserved, but it'll
all become very noisy.

Nick, Hugh: agree?

  reply	other threads:[~2007-03-30 20:44 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-03-29 20:39 Brian Pomerantz
2007-03-30 20:43 ` Andrew Morton [this message]
2007-03-30 22:01   ` Hugh Dickins
2007-03-30 22:13     ` Andrew Morton
2007-03-30 23:06       ` Hugh Dickins
2007-03-31 12:59       ` David Howells
2007-03-31 12:57     ` David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20070330134359.ec6d95bc.akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=bapper@piratehaven.org \
    --cc=hugh@veritas.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nickpiggin@yahoo.com.au \
    --cc=viro@zeniv.linux.org.uk \
    --subject='Re: [PATCH] fix page leak during core dump' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).