LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Eric Biggers <ebiggers3@gmail.com>,
	"Eric W. Biederman" <ebiederm@xmission.com>
Cc: syzbot <syzbot+7a1cff37dbbef9e7ba4c@syzkaller.appspotmail.com>,
	akpm@linux-foundation.org, dhowells@redhat.com,
	gs051095@gmail.com, linux-kernel@vger.kernel.org,
	oleg@redhat.com, pasha.tatashin@oracle.com, riel@redhat.com,
	rppt@linux.vnet.ibm.com, syzkaller-bugs@googlegroups.com,
	wangkefeng.wang@huawei.com, viro@ZenIV.linux.org.uk
Subject: Re: KASAN: use-after-free Read in alloc_pid
Date: Tue, 3 Apr 2018 19:45:10 +0900	[thread overview]
Message-ID: <5a529481-6fd4-bc8d-6b13-31357d9ae633@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <20180403031021.GB685@sol.localdomain>

On 2018/04/03 12:10, Eric Biggers wrote:
> On Mon, Apr 02, 2018 at 06:00:57PM -0500, Eric W. Biederman wrote:
>> syzbot <syzbot+7a1cff37dbbef9e7ba4c@syzkaller.appspotmail.com> writes:
>>
>>> Hello,
>>>
>>> syzbot hit the following crash on upstream commit
>>> 9dd2326890d89a5179967c947dab2bab34d7ddee (Fri Mar 30 17:29:47 2018 +0000)
>>> Merge tag 'ceph-for-4.16-rc8' of git://github.com/ceph/ceph-client
>>> syzbot dashboard link:
>>> https://syzkaller.appspot.com/bug?extid=7a1cff37dbbef9e7ba4c
>>>
>>> So far this crash happened 4 times on upstream.
>>>
>>> Unfortunately, I don't have any reproducer for this crash yet.
>>
>> Do you have any of the other traces?  This looks like a something is
>> calling put_pid_ns more than it is calling get_pid_ns causing a
>> reference count mismatch.
>>
>> If this is not: 9ee332d99e4d5a97548943b81c54668450ce641b

Yes, that commit is the trigger. Al wrote patches. Let's check them.

  http://lkml.kernel.org/r/20180402143415.GC30522@ZenIV.linux.org.uk
  http://lkml.kernel.org/r/20180403052009.GH30522@ZenIV.linux.org.uk

----------
struct pid *alloc_pid(struct pid_namespace *ns) {
(...snipped...)
    if (unlikely(is_child_reaper(pid))) {
        if (pid_ns_prepare_proc(ns)) // ns is freed upon failure.
            goto out_free;
    }
(...snipped...)
out_free:
    spin_lock_irq(&pidmap_lock);
    while (++i <= ns->level) // <= ns is already freed by destroy_pid_namespace() explained below.
        idr_remove(&ns->idr, (pid->numbers + i)->nr);
(...snipped...)
}
----------

----------
int pid_ns_prepare_proc(struct pid_namespace *ns) {
  mnt = kern_mount_data(&proc_fs_type, ns) { // <= ns is passed as ns.
    mnt = vfs_kern_mount(type, SB_KERNMOUNT, type->name, data) { // <= ns is passed as data.
      root = mount_fs(type, SB_KERNMOUNT, name, data) { // <= ns is passed as data.
        root = type->mount(type, SB_KERNMOUNT, name, data) = // <= ns is passed as data.
        static struct dentry *proc_mount(struct file_system_type *fs_type, int flags, const char *dev_name, void *data) {
          return mount_ns(fs_type, SB_KERNMOUNT, NULL, ns, ns->user_ns, proc_fill_super) { // <= ns is passed as ns.
            sb = sget_userns(fs_type, ns_test_super, ns_set_super, SB_KERNMOUNT, user_ns, ns) { // <= ns is passed as ns.
              err = set(s, data) = // <= ns is passed as data.
              static int ns_set_super(struct super_block *sb, void *data) {
                sb->s_fs_info = data; // ns is associated here.
              }
              err = register_shrinker(&s->s_shrink); // <= fail by fault injection.
              deactivate_locked_super(s) {
                fs->kill_sb(s) =
                static void proc_kill_sb(struct super_block *sb) {
                  ns = (struct pid_namespace *)sb->s_fs_info;
                  put_pid_ns(ns) { // <= ns is passed as ns
                    kref_put(&ns->kref, free_pid_ns) { // <= ns refcount becomes 0
                      destroy_pid_namespace(ns) {
                        call_rcu(&ns->rcu, delayed_free_pidns) {
                          kmem_cache_free(pid_ns_cachep, ns); // <= ns is released here after RCU grace period
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
----------

>>
>> I could use a few more hints to help narrow down what is going wrong.
>>
>> It would be nice to know what the other 3 crashes looked like and
>> exactly which upstream they were on.
>>
> 
> The other crashes are shown on the syzbot dashboard (link was given in the
> original email).
> 
> Eric
> 

  reply	other threads:[~2018-04-03 10:46 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-01  8:21 syzbot
2018-04-02 23:00 ` Eric W. Biederman
2018-04-03  3:10   ` Eric Biggers
2018-04-03 10:45     ` Tetsuo Handa [this message]
2018-04-10 14:11 ` syzbot
2018-04-10 14:33   ` Tetsuo Handa
2018-04-21 10:43     ` Tetsuo Handa
2018-04-24 16:33       ` Eric W. Biederman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5a529481-6fd4-bc8d-6b13-31357d9ae633@I-love.SAKURA.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=akpm@linux-foundation.org \
    --cc=dhowells@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=ebiggers3@gmail.com \
    --cc=gs051095@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=oleg@redhat.com \
    --cc=pasha.tatashin@oracle.com \
    --cc=riel@redhat.com \
    --cc=rppt@linux.vnet.ibm.com \
    --cc=syzbot+7a1cff37dbbef9e7ba4c@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@ZenIV.linux.org.uk \
    --cc=wangkefeng.wang@huawei.com \
    --subject='Re: KASAN: use-after-free Read in alloc_pid' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).