Alexey Dobriyan
8a3f4baaa4
proc: fix coredump vs read /proc/*/stat race ...
commit 8bb2ee192e482c5d500df9f2b1b26a560bd3026f upstream.
do_task_stat() accesses IP and SP of a task without bumping reference
count of a stack (which became an entity with independent lifetime at
some point).
Steps to reproduce:
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/time.h>
#include <sys/resource.h>
#include <unistd.h>
#include <sys/wait.h>
int main(void)
{
setrlimit(RLIMIT_CORE, &(struct rlimit){});
while (1) {
char buf[64];
char buf2[4096];
pid_t pid;
int fd;
pid = fork();
if (pid == 0) {
*(volatile int *)0 = 0;
}
snprintf(buf, sizeof(buf), "/proc/%u/stat", pid);
fd = open(buf, O_RDONLY);
read(fd, buf2, sizeof(buf2));
close(fd);
waitpid(pid, NULL, 0);
}
return 0;
}
BUG: unable to handle kernel paging request at 0000000000003fd8
IP: do_task_stat+0x8b4/0xaf0
PGD 800000003d73e067 P4D 800000003d73e067 PUD 3d558067 PMD 0
Oops: 0000 [#1 ] PREEMPT SMP PTI
CPU: 0 PID: 1417 Comm: a.out Not tainted 4.15.0-rc8-dirty #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc27 04/01/2014
RIP: 0010:do_task_stat+0x8b4/0xaf0
Call Trace:
proc_single_show+0x43/0x70
seq_read+0xe6/0x3b0
__vfs_read+0x1e/0x120
vfs_read+0x84/0x110
SyS_read+0x3d/0xa0
entry_SYSCALL_64_fastpath+0x13/0x6c
RIP: 0033:0x7f4d7928cba0
RSP: 002b:00007ffddb245158 EFLAGS: 00000246
Code: 03 b7 a0 01 00 00 4c 8b 4c 24 70 4c 8b 44 24 78 4c 89 74 24 18 e9 91 f9 ff ff f6 45 4d 02 0f 84 fd f7 ff ff 48 8b 45 40 48 89 ef <48> 8b 80 d8 3f 00 00 48 89 44 24 20 e8 9b 97 eb ff 48 89 44 24
RIP: do_task_stat+0x8b4/0xaf0 RSP: ffffc90000607cc8
CR2: 0000000000003fd8
John Ogness said: for my tests I added an else case to verify that the
race is hit and correctly mitigated.
Link: http://lkml.kernel.org/r/20180116175054.GA11513@avx2
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reported-by: "Kohli, Gaurav" <gkohli@codeaurora.org>
Tested-by: John Ogness <john.ogness@linutronix.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-23 19:57:08 +01:00
2017-11-30 08:39:05 +00:00
2016-10-10 20:16:43 -07:00
2016-10-10 20:16:43 -07:00
2017-12-20 10:07:25 +01:00
2017-12-20 10:07:15 +01:00
2016-10-15 12:09:13 -07:00
2016-10-10 23:02:51 -04:00
2017-12-25 14:23:43 +01:00
2016-10-10 20:16:43 -07:00
2017-12-20 10:07:16 +01:00
2017-11-08 10:08:31 +01:00
2017-11-24 08:33:42 +01:00
2017-06-24 07:11:12 +02:00
2017-11-30 08:39:11 +00:00
2017-08-06 18:59:43 -07:00
2016-10-10 20:16:43 -07:00
2017-09-09 17:39:40 +02:00
2017-11-30 08:39:03 +00:00
2016-10-10 20:16:43 -07:00
2016-05-20 17:58:30 -07:00
2016-10-27 18:43:43 -07:00
2016-10-06 09:07:44 -04:00
2017-07-27 15:08:02 -07:00
2017-12-20 10:07:17 +01:00
2017-11-30 08:39:11 +00:00
2017-03-15 10:02:52 +08:00
2016-06-13 10:20:39 +02:00
2017-10-27 10:38:11 +02:00
2017-11-02 09:49:13 +01:00
2017-12-20 10:07:30 +01:00
2016-10-10 20:16:43 -07:00
2017-07-27 15:08:07 -07:00
2016-10-10 20:16:43 -07:00
2016-10-10 20:16:43 -07:00
2017-10-08 10:26:09 +02:00
2017-11-30 08:39:04 +00:00
2017-03-30 09:41:27 +02:00
2016-10-10 20:16:43 -07:00
2017-08-06 18:59:39 -07:00
2016-10-27 17:47:11 +02:00
2017-11-30 08:39:06 +00:00
2016-10-10 20:16:43 -07:00
2016-10-10 20:16:43 -07:00
2016-10-10 20:16:43 -07:00
2017-12-20 10:07:26 +01:00
2018-01-10 09:29:52 +01:00
2017-11-30 08:39:03 +00:00
2017-08-06 18:59:43 -07:00
2016-10-30 13:09:42 -04:00
2017-11-24 08:33:42 +01:00
2016-10-10 20:16:43 -07:00
2016-09-27 21:06:21 -04:00
2017-09-27 14:39:18 +02:00
2017-07-27 15:08:07 -07:00
2018-01-23 19:57:08 +01:00
2017-08-06 18:59:43 -07:00
2016-08-15 17:43:31 +02:00
2016-10-10 20:16:43 -07:00
2017-07-27 15:08:08 -07:00
2017-06-17 06:41:56 +02:00
2016-10-07 21:48:36 -04:00
2017-04-12 12:41:11 +02:00
2016-10-10 20:16:43 -07:00
2016-09-27 21:06:21 -04:00
2017-07-27 15:08:04 -07:00
2017-12-20 10:07:33 +01:00
2017-06-14 15:06:01 +02:00
2017-12-20 10:07:31 +01:00
2017-07-05 14:40:26 +02:00
2016-10-10 20:16:43 -07:00
2017-01-09 08:32:24 +01:00
2016-05-28 16:34:59 -07:00
2016-07-25 16:51:49 +10:00
2017-07-21 07:42:21 +02:00
2016-08-02 19:35:15 -04:00
2016-07-28 13:29:12 +10:00
2016-09-27 21:06:22 -04:00
2017-10-18 09:35:39 +02:00
2017-06-14 15:06:00 +02:00
2016-08-23 22:58:51 -07:00
2016-09-24 09:27:18 +02:00
2016-09-27 21:20:53 -04:00
2017-07-05 14:40:26 +02:00
2017-12-09 22:01:49 +01:00
2017-08-06 18:59:43 -07:00
2017-10-18 09:35:41 +02:00
2017-09-07 08:35:41 +02:00
2017-07-21 07:42:22 +02:00
2017-07-12 15:01:02 +02:00
2016-09-27 18:47:38 -04:00
2017-12-20 10:07:20 +01:00
2017-09-20 08:20:01 +02:00
2017-09-20 08:20:01 +02:00
2016-09-15 13:29:52 -07:00
2017-09-20 08:19:59 +02:00
2016-10-07 18:46:29 -07:00
2016-08-12 16:47:05 +01:00
2017-12-09 22:01:51 +01:00
2016-10-18 12:21:28 +02:00
2016-06-21 09:23:11 +10:00
2016-08-31 11:44:36 -04:00
2017-07-21 07:42:22 +02:00
2017-10-18 09:35:39 +02:00
2017-11-08 10:08:36 +01:00
2017-07-21 07:42:22 +02:00
2016-10-10 20:16:43 -07:00
2017-07-12 15:01:02 +02:00
2018-01-23 19:57:06 +01:00
2017-07-21 07:42:22 +02:00
2017-03-15 10:02:43 +08:00
2017-01-26 08:24:37 +01:00
2017-10-12 11:51:26 +02:00
2016-05-26 00:13:25 -04:00
2016-10-11 15:06:30 -07:00
2016-10-07 18:46:30 -07:00
2017-02-23 17:44:35 +01:00
2017-06-14 15:06:01 +02:00
2017-03-15 10:02:44 +08:00
2017-05-08 07:47:54 +02:00
2017-12-20 10:07:18 +01:00
2016-10-08 11:06:08 -04:00
2017-10-12 11:51:19 +02:00
8a3f4baaa4