p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/fs
History
Alexey Dobriyan 8bb2ee192e proc: fix coredump vs read /proc/*/stat race 
do_task_stat() accesses IP and SP of a task without bumping reference
count of a stack (which became an entity with independent lifetime at
some point).

Steps to reproduce:

    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>
    #include <sys/time.h>
    #include <sys/resource.h>
    #include <unistd.h>
    #include <sys/wait.h>

    int main(void)
    {
    	setrlimit(RLIMIT_CORE, &(struct rlimit){});

    	while (1) {
    		char buf[64];
    		char buf2[4096];
    		pid_t pid;
    		int fd;

    		pid = fork();
    		if (pid == 0) {
    			*(volatile int *)0 = 0;
    		}

    		snprintf(buf, sizeof(buf), "/proc/%u/stat", pid);
    		fd = open(buf, O_RDONLY);
    		read(fd, buf2, sizeof(buf2));
    		close(fd);

    		waitpid(pid, NULL, 0);
    	}
    	return 0;
    }

    BUG: unable to handle kernel paging request at 0000000000003fd8
    IP: do_task_stat+0x8b4/0xaf0
    PGD 800000003d73e067 P4D 800000003d73e067 PUD 3d558067 PMD 0
    Oops: 0000 [#1] PREEMPT SMP PTI
    CPU: 0 PID: 1417 Comm: a.out Not tainted 4.15.0-rc8-dirty #2
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
    RIP: 0010:do_task_stat+0x8b4/0xaf0
    Call Trace:
     proc_single_show+0x43/0x70
     seq_read+0xe6/0x3b0
     __vfs_read+0x1e/0x120
     vfs_read+0x84/0x110
     SyS_read+0x3d/0xa0
     entry_SYSCALL_64_fastpath+0x13/0x6c
    RIP: 0033:0x7f4d7928cba0
    RSP: 002b:00007ffddb245158 EFLAGS: 00000246
    Code: 03 b7 a0 01 00 00 4c 8b 4c 24 70 4c 8b 44 24 78 4c 89 74 24 18 e9 91 f9 ff ff f6 45 4d 02 0f 84 fd f7 ff ff 48 8b 45 40 48 89 ef <48> 8b 80 d8 3f 00 00 48 89 44 24 20 e8 9b 97 eb ff 48 89 44 24
    RIP: do_task_stat+0x8b4/0xaf0 RSP: ffffc90000607cc8
    CR2: 0000000000003fd8

John Ogness said: for my tests I added an else case to verify that the
race is hit and correctly mitigated.

Link: http://lkml.kernel.org/r/20180116175054.GA11513@avx2
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: "Kohli, Gaurav" <gkohli@codeaurora.org>
Tested-by: John Ogness <john.ogness@linutronix.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 		2018-01-19 10:09:41 -08:00
..
9p Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
adfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
affs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
afs afs: Fix missing error handling in afs_write_end() 2018-01-02 10:02:19 +00:00
autofs4 autofs: fix careless error in recent commit 2017-12-14 16:00:48 -08:00
befs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
bfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
btrfs for-4.15-rc7-tag 2018-01-05 13:02:46 -08:00
cachefiles mm: remove __GFP_COLD 2017-11-15 18:21:06 -08:00
ceph ceph: drop negative child dentries before try pruning inode's alias 2017-12-08 11:07:12 +01:00
cifs CIFS: don't log STATUS_NOT_FOUND errors for DFS 2017-12-06 12:48:01 -06:00
coda Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
configfs configfs: make ci_type field, some pointers and function arguments const 2017-10-19 16:15:16 +02:00
cramfs cramfs: fix MTD dependency 2017-12-17 12:20:58 -08:00
crypto fscrypt: lots of cleanups, mostly courtesy by Eric Biggers 2017-11-14 11:35:15 -08:00
debugfs debugfs: Remove redundant license text 2017-11-07 20:25:03 +01:00
devpts pty: Repair TIOCGPTPEER 2017-08-24 13:23:03 -07:00
dlm A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
ecryptfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
efivarfs VFS: Kill off s_options and helpers 2017-07-11 06:09:21 -04:00
efs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
exofs Merge branch 'for-4.14/block' of git://git.kernel.dk/linux-block 2017-09-07 11:59:42 -07:00
exportfs
…
ext2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ext4 ext4: fix crash when a directory's i_size is too small 2017-12-11 15:00:57 -05:00
f2fs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
fat fs/fat/inode.c: fix sb_rdonly() change 2017-11-29 18:40:43 -08:00
freevxfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
fscache AFS development 2017-11-16 11:41:22 -08:00
fuse Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
gfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hfsplus Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
hostfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hpfs hpfs: don't bother with the i_version counter or f_version 2017-12-10 12:58:18 -08:00
hugetlbfs fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() 2017-11-29 18:40:43 -08:00
isofs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
jbd2 libnvdimm for 4.15 2017-11-17 09:51:57 -08:00
jffs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
jfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
kernfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
lockd nlm_shutdown_hosts_net() cleanup 2017-11-27 16:45:11 -05:00
minix Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ncpfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
nfs NFS client fixes for Linux 4.15-rc4 2017-12-16 13:12:53 -08:00
nfs_common lockd: fix "list_add double add" caused by legacy signal interface 2017-11-27 16:45:11 -05:00
nfsd kernel: make groups_sort calling a responsibility group_info allocators 2017-12-14 16:00:49 -08:00
nilfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
nls License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
notify Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ntfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ocfs2 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
omfs License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
openpromfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
orangefs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
overlayfs ovl: fix overlay: warning prefix 2017-12-14 11:14:52 +01:00
proc proc: fix coredump vs read /proc/*/stat race 2018-01-19 10:09:41 -08:00
pstore treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
qnx4 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
qnx6 Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
quota quota: Check for register_shrinker() failure. 2017-11-29 16:46:48 +01:00
ramfs mm: make pagevec_lookup() update index 2017-09-06 17:27:26 -07:00
reiserfs Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 2017-11-30 18:38:47 -05:00
romfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
squashfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
sysfs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
sysv Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
tracefs VFS: Don't use save/replace_mount_options if not using generic_show_options 2017-07-06 03:31:46 -04:00
ubifs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
udf Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
ufs Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
xfs Changes since last update: 2018-01-05 12:59:32 -08:00
Kconfig fs/Kconfig: kill CONFIG_PERCPU_RWSEM some more 2017-07-12 16:26:00 -07:00
Kconfig.binfmt ARM: enable elf_fdpic on systems with an MMU 2017-09-10 19:31:46 -04:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
aio.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
anon_inodes.c
…
attr.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bad_inode.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
binfmt_aout.c fs: fix kernel_read prototype 2017-09-04 19:05:15 -04:00
binfmt_elf.c Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 2017-11-16 12:50:35 -08:00
binfmt_elf_fdpic.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
binfmt_em86.c
…
binfmt_flat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
binfmt_misc.c fs/binfmt_misc.c: node could be NULL when evicting inode 2017-10-13 16:18:33 -07:00
binfmt_script.c exec: load_script: kill the onstack interp[BINPRM_BUF_SIZE] array 2017-10-03 17:54:25 -07:00
block_dev.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
buffer.c mm, pagevec: remove cold parameter for pagevecs 2017-11-15 18:21:06 -08:00
char_dev.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
compat.c
…
compat_binfmt_elf.c
…
compat_ioctl.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
coredump.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
dax.c Revert "mm: replace p??_write with pte_access_permitted in fault + gup paths" 2017-12-15 18:53:22 -08:00
dcache.c kmemcheck: remove annotations 2017-11-15 18:21:04 -08:00
dcookies.c
…
direct-io.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
drop_caches.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
eventfd.c There has been a fair amount of activity in the docs tree this time 2017-07-03 21:13:25 -07:00
eventpoll.c Merge branch 'akpm' (patches from Andrew) 2017-11-17 16:56:17 -08:00
exec.c exec: Weaken dumpability for secureexec 2018-01-03 10:13:36 -08:00
fcntl.c fcntl: don't cap l_start and l_end values for F_GETLK64 in compat syscall 2017-11-15 08:08:36 -05:00
fhandle.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
file.c Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:54:01 -08:00
file_table.c fs, mm: account filp cache to kmemcg 2017-11-15 18:21:04 -08:00
filesystems.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs-writeback.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
fs_pin.c Merge branch 'linus' into locking/core, to resolve conflicts 2017-11-07 10:32:44 +01:00
fs_struct.c
…
inode.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
internal.h fs: expose do_unlinkat for built-in callers 2017-11-10 08:48:46 -05:00
ioctl.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
iomap.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:08:18 -08:00
libfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
locks.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
mbcache.c fs/mbcache.c: make count_objects() more robust 2017-11-29 18:40:43 -08:00
mount.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mpage.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
namei.c autofs: revert "autofs: fix AT_NO_AUTOMOUNT not being honored" 2017-11-29 18:40:43 -08:00
namespace.c VFS: Handle lazytime in do_mount() 2017-12-09 20:16:33 -05:00
no-block.c
…
nsfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
open.c ovl: don't allow writing ioctl on lower layer 2017-09-05 12:53:12 +02:00
pipe.c pipe: add proc_dopipe_max_size() to safely assign pipe_max_size 2017-11-17 16:10:03 -08:00
pnode.c
…
pnode.h
…
posix_acl.c
…
proc_namespace.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
read_write.c Merge branch 'work.iov_iter' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 12:08:18 -08:00
readdir.c Merge branch 'linus' into locking/core, to resolve conflicts 2017-11-07 10:32:44 +01:00
select.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
seq_file.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
signalfd.c Merge branch 'misc.compat' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2017-11-17 11:54:55 -08:00
splice.c locking/atomics: COCCINELLE/treewide: Convert trivial ACCESS_ONCE() patterns to READ_ONCE()/WRITE_ONCE() 2017-10-25 11:01:08 +02:00
stack.c
…
stat.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
statfs.c Rename superblock flags (MS_xyz -> SB_xyz) 2017-11-27 13:05:09 -08:00
super.c sget(): handle failures of register_shrinker() 2017-12-18 15:05:07 -05:00
sync.c Merge branch 'for-4.15/block' of git://git.kernel.dk/linux-block 2017-11-14 15:32:19 -08:00
timerfd.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
userfaultfd.c userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails 2018-01-04 16:45:09 -08:00
utimes.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
xattr.c lsm: fix smack_inode_removexattr and xattr_getsecurity memleak 2017-10-04 18:03:15 +11:00