Alexey Dobriyan
8bb2ee192e
proc: fix coredump vs read /proc/*/stat race
do_task_stat() accesses IP and SP of a task without bumping reference
count of a stack (which became an entity with independent lifetime at
some point).
Steps to reproduce:
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <sys/wait.h>
int main(void)
{
setrlimit(RLIMIT_CORE, &(struct rlimit){});
while (1) {
char buf[64];
char buf2[4096];
pid_t pid;
int fd;
pid = fork();
if (pid == 0) {
*(volatile int *)0 = 0;
}
snprintf(buf, sizeof(buf), "/proc/%u/stat", pid);
fd = open(buf, O_RDONLY);
read(fd, buf2, sizeof(buf2));
close(fd);
waitpid(pid, NULL, 0);
}
return 0;
}
BUG: unable to handle kernel paging request at 0000000000003fd8
IP: do_task_stat+0x8b4/0xaf0
PGD 800000003d73e067 P4D 800000003d73e067 PUD 3d558067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 1417 Comm: a.out Not tainted 4.15.0-rc8-dirty #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
RIP: 0010:do_task_stat+0x8b4/0xaf0
Call Trace:
proc_single_show+0x43/0x70
seq_read+0xe6/0x3b0
__vfs_read+0x1e/0x120
vfs_read+0x84/0x110
SyS_read+0x3d/0xa0
entry_SYSCALL_64_fastpath+0x13/0x6c
RIP: 0033:0x7f4d7928cba0
RSP: 002b:00007ffddb245158 EFLAGS: 00000246
Code: 03 b7 a0 01 00 00 4c 8b 4c 24 70 4c 8b 44 24 78 4c 89 74 24 18 e9 91 f9 ff ff f6 45 4d 02 0f 84 fd f7 ff ff 48 8b 45 40 48 89 ef <48> 8b 80 d8 3f 00 00 48 89 44 24 20 e8 9b 97 eb ff 48 89 44 24
RIP: do_task_stat+0x8b4/0xaf0 RSP: ffffc90000607cc8
CR2: 0000000000003fd8
John Ogness said: for my tests I added an else case to verify that the
race is hit and correctly mitigated.
Link: http://lkml.kernel.org/r/20180116175054.GA11513@avx2
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: "Kohli, Gaurav" <gkohli@codeaurora.org>
Tested-by: John Ogness <john.ogness@linutronix.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-01-19 10:09:41 -08:00
..
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2018-01-02 10:02:19 +00:00
2017-12-14 16:00:48 -08:00
2017-11-27 13:05:09 -08:00
2017-11-02 11:10:55 +01:00
2018-01-05 13:02:46 -08:00
2017-11-15 18:21:06 -08:00
2017-12-08 11:07:12 +01:00
2017-12-06 12:48:01 -06:00
2017-11-27 13:05:09 -08:00
2017-10-19 16:15:16 +02:00
2017-12-17 12:20:58 -08:00
2017-11-14 11:35:15 -08:00
2017-11-07 20:25:03 +01:00
2017-11-14 14:44:04 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-12-11 15:00:57 -05:00
2017-11-27 13:05:09 -08:00
2017-11-29 18:40:43 -08:00
2017-11-27 13:05:09 -08:00
2017-11-16 11:41:22 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-02 11:10:55 +01:00
2017-12-10 12:58:18 -08:00
2017-11-29 18:40:43 -08:00
2017-11-27 13:05:09 -08:00
2017-11-17 09:51:57 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 16:45:11 -05:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-12-16 13:12:53 -08:00
2017-11-27 16:45:11 -05:00
2017-12-14 16:00:49 -08:00
2017-11-27 13:05:09 -08:00
2017-11-02 11:10:55 +01:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-02 11:10:55 +01:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-12-14 11:14:52 +01:00
2018-01-19 10:09:41 -08:00
2017-11-21 15:57:05 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-29 16:46:48 +01:00
2017-11-30 18:38:47 -05:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2018-01-05 12:59:32 -08:00
2017-11-17 11:54:55 -08:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-17 12:54:01 -08:00
2017-11-16 12:50:35 -08:00
2017-11-02 11:10:55 +01:00
2017-10-13 16:18:33 -07:00
2017-10-03 17:54:25 -07:00
2017-11-14 15:32:19 -08:00
2017-11-15 18:21:06 -08:00
2017-11-02 11:10:55 +01:00
2017-11-17 12:54:01 -08:00
2017-11-17 11:54:55 -08:00
2017-12-15 18:53:22 -08:00
2017-11-15 18:21:04 -08:00
2017-11-14 15:32:19 -08:00
2017-11-02 11:10:55 +01:00
2017-11-17 16:56:17 -08:00
2018-01-03 10:13:36 -08:00
2017-11-15 08:08:36 -05:00
2017-11-17 12:54:01 -08:00
2017-11-15 18:21:04 -08:00
2017-11-17 12:54:01 -08:00
2017-11-02 11:10:55 +01:00
2017-11-07 10:32:44 +01:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-10 08:48:46 -05:00
2017-11-02 11:10:55 +01:00
2017-11-17 12:08:18 -08:00
2017-11-27 13:05:09 -08:00
2017-11-27 13:05:09 -08:00
2017-11-02 11:10:55 +01:00
2017-11-29 18:40:43 -08:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-29 18:40:43 -08:00
2017-12-09 20:16:33 -05:00
2017-11-27 13:05:09 -08:00
2017-11-17 16:10:03 -08:00
2017-11-27 13:05:09 -08:00
2017-11-17 12:08:18 -08:00
2017-11-07 10:32:44 +01:00
2017-11-17 11:54:55 -08:00
2017-11-02 11:10:55 +01:00
2017-11-17 11:54:55 -08:00
2017-10-25 11:01:08 +02:00
2017-11-02 11:10:55 +01:00
2017-11-27 13:05:09 -08:00
2017-12-18 15:05:07 -05:00
2017-11-14 15:32:19 -08:00
2017-11-02 11:10:55 +01:00
2018-01-04 16:45:09 -08:00
2017-11-02 11:10:55 +01:00
2017-10-04 18:03:15 +11:00