unimore/kernel-hacking-2024-linux-steffo
unimore/kernel-hacking-2024-linux-steffo
1
Fork 0
Code Pull requests 5 Wiki Activity
kernel-hacking-2024-linux-s.../fs
History
Alexey Dobriyan 5a622f2d0f proc: fix proc_dir_entry refcounting 
Creating PDEs with refcount 0 and "deleted" flag has problems (see below).
Switch to usual scheme:
* PDE is created with refcount 1
* every de_get does +1
* every de_put() and remove_proc_entry() do -1
* once refcount reaches 0, PDE is freed.

This elegantly fixes at least two following races (both observed) without
introducing new locks, without abusing old locks, without spreading
lock_kernel():

1) PDE leak

remove_proc_entry			de_put
-----------------			------
			[refcnt = 1]
if (atomic_read(&de->count) == 0)
					if (atomic_dec_and_test(&de->count))
						if (de->deleted)
							/* also not taken! */
							free_proc_entry(de);
else
	de->deleted = 1;
		[refcount=0, deleted=1]

2) use after free

remove_proc_entry			de_put
-----------------			------
			[refcnt = 1]

					if (atomic_dec_and_test(&de->count))
if (atomic_read(&de->count) == 0)
	free_proc_entry(de);
						/* boom! */
						if (de->deleted)
							free_proc_entry(de);

BUG: unable to handle kernel paging request at virtual address 6b6b6b6b
printing eip: c10acdda *pdpt = 00000000338f8001 *pde = 0000000000000000
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: af_packet ipv6 cpufreq_ondemand loop serio_raw psmouse k8temp hwmon sr_mod cdrom
Pid: 23161, comm: cat Not tainted (2.6.24-rc2-8c0863403f109a43d7000b4646da4818220d501f #4)
EIP: 0060:[<c10acdda>] EFLAGS: 00210097 CPU: 1
EIP is at strnlen+0x6/0x18
EAX: 6b6b6b6b EBX: 6b6b6b6b ECX: 6b6b6b6b EDX: fffffffe
ESI: c128fa3b EDI: f380bf34 EBP: ffffffff ESP: f380be44
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process cat (pid: 23161, ti=f380b000 task=f38f2570 task.ti=f380b000)
Stack: c10ac4f0 00000278 c12ce000 f43cd2a8 00000163 00000000 7da86067 00000400
       c128fa20 00896b18 f38325a8 c128fe20 ffffffff 00000000 c11f291e 00000400
       f75be300 c128fa20 f769c9a0 c10ac779 f380bf34 f7bfee70 c1018e6b f380bf34
Call Trace:
 [<c10ac4f0>] vsnprintf+0x2ad/0x49b
 [<c10ac779>] vscnprintf+0x14/0x1f
 [<c1018e6b>] vprintk+0xc5/0x2f9
 [<c10379f1>] handle_fasteoi_irq+0x0/0xab
 [<c1004f44>] do_IRQ+0x9f/0xb7
 [<c117db3b>] preempt_schedule_irq+0x3f/0x5b
 [<c100264e>] need_resched+0x1f/0x21
 [<c10190ba>] printk+0x1b/0x1f
 [<c107c8ad>] de_put+0x3d/0x50
 [<c107c8f8>] proc_delete_inode+0x38/0x41
 [<c107c8c0>] proc_delete_inode+0x0/0x41
 [<c1066298>] generic_delete_inode+0x5e/0xc6
 [<c1065aa9>] iput+0x60/0x62
 [<c1063c8e>] d_kill+0x2d/0x46
 [<c1063fa9>] dput+0xdc/0xe4
 [<c10571a1>] __fput+0xb0/0xcd
 [<c1054e49>] filp_close+0x48/0x4f
 [<c1055ee9>] sys_close+0x67/0xa5
 [<c10026b6>] sysenter_past_esp+0x5f/0x85
=======================
Code: c9 74 0c f2 ae 74 05 bf 01 00 00 00 4f 89 fa 5f 89 d0 c3 85 c9 57 89 c7 89 d0 74 05 f2 ae 75 01 4f 89 f8 5f c3 89 c1 89 c8 eb 06 <80> 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 c3 90 90 90 57 83 c9
EIP: [<c10acdda>] strnlen+0x6/0x18 SS:ESP 0068:f380be44

Also, remove broken usage of ->deleted from reiserfs: if sget() succeeds,
module is already pinned and remove_proc_entry() can't happen => nobody
can mark PDE deleted.

Dummy proc root in netns code is not marked with refcount 1. AFAICS, we
never get it, it's just for proper /proc/net removal. I double checked
CLONE_NETNS continues to work.

Patch survives many hours of modprobe/rmmod/cat loops without new bugs
which can be attributed to refcounting.

Signed-off-by: Alexey Dobriyan <adobriyan@sw.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-12-05 09:21:20 -08:00
..
9p 9p: use copy of the options value instead of original 2007-11-06 08:02:53 -06:00
adfs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
affs fs: mark nibblemap const 2007-10-17 08:42:47 -07:00
afs fs/afs/vlocation.c: fix off-by-one 2007-11-05 15:12:32 -08:00
autofs Use task_pid_nr() instead of pid_nr(task_pid()) 2007-10-19 11:53:43 -07:00
autofs4 pid namespaces: round up the API 2007-10-19 11:53:37 -07:00
befs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
bfs Fixes to the BFS filesystem driver 2007-11-14 18:45:40 -08:00
cifs [CIFS] Fix check after use error in ACL code 2007-11-25 10:01:00 +00:00
coda pid namespaces: round up the API 2007-10-19 11:53:37 -07:00
configfs r/o bind mounts: filesystem helpers for custom 'struct file's 2007-10-17 08:43:04 -07:00
cramfs fs/cramfs/inode.c: replace hardcoded value with preprocessor constant 2007-10-18 14:37:29 -07:00
debugfs [PATCH] pass dentry to audit_inode()/audit_inode_child() 2007-10-21 02:37:18 -04:00
devpts
dlm [DLM] lowcomms: Do not muck with sysctl_rmem_max. 2007-11-07 04:11:42 -08:00
ecryptfs eCryptfs: cast page->index to loff_t instead of off_t 2007-11-14 18:45:36 -08:00
efs exportfs: make struct export_operations const 2007-10-22 08:13:21 -07:00
exportfs exportfs: update documentation 2007-10-22 08:13:21 -07:00
ext2 fix up ext2_fs.h for userspace after reservations backport 2007-11-29 09:24:53 -08:00
ext3 Fix 64KB blocksize in ext3 directories 2007-11-14 18:45:43 -08:00
ext4 Forbid user to change file flags on quota files 2007-11-14 18:45:38 -08:00
fat exportfs: make struct export_operations const 2007-10-22 08:13:21 -07:00
freevxfs
fuse fuse: fix attribute caching after rename 2007-11-29 09:24:54 -08:00
gfs2 exportfs: make struct export_operations const 2007-10-22 08:13:21 -07:00
hfs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
hfsplus Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
hostfs uml: fix hostfs style 2007-10-16 09:43:07 -07:00
hpfs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
hppfs
hugetlbfs hugetlb: allow bulk updating in hugetlb_*_quota() 2007-11-14 18:45:40 -08:00
isofs exportfs: make struct export_operations const 2007-10-22 08:13:21 -07:00
jbd jbd: Fix assertion failure in fs/jbd/checkpoint.c 2007-12-05 09:21:20 -08:00
jbd2 JBD2: debug code cleanup. 2007-10-17 18:49:59 -04:00
jffs2 [JFFS2] Prevent return of initialised variable in jffs2_init_acl_post() 2007-10-27 10:36:44 -04:00
jfs Forbid user to change file flags on quota files 2007-11-14 18:45:38 -08:00
lockd
minix limit minixfs printks on corrupted dir i_size 2007-10-17 08:42:53 -07:00
msdos
ncpfs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
nfs NFS: Clean up new multi-segment direct I/O changes 2007-11-26 16:32:40 -05:00
nfs_common
nfsd nfsd4: recheck for secure ports in fh_verify 2007-11-12 14:28:08 -08:00
nls sparse pointer use of zero as null 2007-10-18 14:37:31 -07:00
ntfs NTFS: Fix read regression. 2007-11-03 12:27:21 -07:00
ocfs2 ocfs2: reverse inline-data truncate args 2007-11-27 16:47:03 -08:00
openpromfs Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
partitions fs/partitions/sun.c endianness annotations 2007-10-14 12:41:51 -07:00
proc proc: fix proc_dir_entry refcounting 2007-12-05 09:21:20 -08:00
qnx4 Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
ramfs Remove valueless definition of hard-selected RAMFS option 2007-10-17 08:42:56 -07:00
reiserfs proc: fix proc_dir_entry refcounting 2007-12-05 09:21:20 -08:00
romfs fs/romfs/inode.c: trivial improvements 2007-10-17 08:42:47 -07:00
smbfs smbfs: fix debug builds 2007-11-14 18:45:43 -08:00
sysfs sysfs: fix off-by-one error in fill_read_buffer() 2007-11-28 13:53:53 -08:00
sysv Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
udf fs/udf/balloc.c: mark a variable as uninitialized_var() 2007-10-17 08:43:00 -07:00
ufs ufs: fix nexstep dir block size 2007-12-05 09:21:18 -08:00
vfat
xfs exportfs: make struct export_operations const 2007-10-22 08:13:21 -07:00
aio.c aio: only account I/O wait time in read_events if there are active requests 2007-12-05 09:21:18 -08:00
anon_inodes.c anon-inodes use open coded atomic_inc for the shared inode 2007-10-17 08:43:00 -07:00
attr.c VFS: make notify_change pass ATTR_KILL_S*ID to setattr operations 2007-10-18 14:37:22 -07:00
bad_inode.c
binfmt_aout.c core_pattern: ignore RLIMIT_CORE if core_pattern is a pipe 2007-10-17 08:42:50 -07:00
binfmt_elf.c pid namespaces: changes to show virtual ids to user 2007-10-19 11:53:40 -07:00
binfmt_elf_fdpic.c pid namespaces: changes to show virtual ids to user 2007-10-19 11:53:40 -07:00
binfmt_em86.c Convert files to UTF-8 and some cleanups 2007-10-19 23:21:04 +02:00
binfmt_flat.c binfmt_flat: warning fixes 2007-10-17 08:42:54 -07:00
binfmt_misc.c Convert files to UTF-8 and some cleanups 2007-10-19 23:21:04 +02:00
binfmt_script.c Convert files to UTF-8 and some cleanups 2007-10-19 23:21:04 +02:00
binfmt_som.c core_pattern: ignore RLIMIT_CORE if core_pattern is a pipe 2007-10-17 08:42:50 -07:00
bio.c bio: make freeing of ->bi_io_vec conditional in bio_free() 2007-10-16 11:03:52 +02:00
block_dev.c Slab API: remove useless ctor parameter and reorder parameters 2007-10-17 08:42:45 -07:00
buffer.c nobh: nobh_write_end fix 2007-10-21 08:54:05 -07:00
char_dev.c mm: bdi init hooks 2007-10-17 08:42:45 -07:00
compat.c
compat_ioctl.c tty: add the new termios2 ioctls to the compatible list. 2007-11-29 09:24:55 -08:00
dcache.c dcache: don't expose uninitialized memory in /proc/<pid>/fd/<fd> 2007-10-22 08:13:18 -07:00
dcookies.c
direct-io.c remove ZERO_PAGE 2007-10-16 09:42:53 -07:00
dnotify.c
dquot.c quota: send messages via netlink 2007-10-17 08:42:56 -07:00
drop_caches.c
eventfd.c
eventpoll.c fs/eventpoll.c: use list_for_each_entry() instead of list_for_each() 2007-10-19 11:53:38 -07:00
exec.c vfs: coredumping fix 2007-11-28 10:58:01 -08:00
fcntl.c pid namespaces: changes to show virtual ids to user 2007-10-19 11:53:40 -07:00
fifo.c
file.c
file_table.c fs/file_table.c: use list_for_each_entry() instead of list_for_each() 2007-10-19 11:53:38 -07:00
filesystems.c
fs-writeback.c Use helpers to obtain task pid in printks 2007-10-19 11:53:43 -07:00
generic_acl.c
inode.c introduce I_SYNC 2007-10-17 08:43:02 -07:00
inotify.c [PATCH] new helper - inotify_evict_watch() 2007-10-21 02:37:38 -04:00
inotify_user.c change inotifyfs magic as the same magic is used for futexfs 2007-10-17 08:43:00 -07:00
internal.h
ioctl.c
ioprio.c ioprio: allow sys_ioprio_set() value of 0 to reset ioprio setting 2007-11-07 13:54:07 +01:00
Kconfig [PATCH] ocfs2: Remove expensive bitmap scanning 2007-11-27 16:47:02 -08:00
Kconfig.binfmt
libfs.c exportfs: add new methods 2007-10-22 08:13:19 -07:00
locks.c locks: fix possible infinite loop in posix deadlock detection 2007-10-30 09:04:18 -07:00
Makefile Remove valueless definition of hard-selected RAMFS option 2007-10-17 08:42:56 -07:00
mbcache.c fs: Fix to correct the mbcache entries counter 2007-10-25 15:18:29 -07:00
mpage.c mm: buffered write cleanup 2007-10-16 09:42:54 -07:00
namei.c [PATCH] pass dentry to audit_inode()/audit_inode_child() 2007-10-21 02:37:18 -04:00
namespace.c [PATCH] new helpers - collect_mounts() and release_collected_mounts() 2007-10-21 02:37:25 -04:00
nfsctl.c
no-block.c
open.c mark sys_open/sys_read exports unused 2007-11-14 18:45:42 -08:00
pipe.c sched: affine sync wakeups 2007-10-15 17:00:19 +02:00
pnode.c
pnode.h [PATCH] new helpers - collect_mounts() and release_collected_mounts() 2007-10-21 02:37:25 -04:00
posix_acl.c
quota.c
quota_v1.c
quota_v2.c
read_write.c mark sys_open/sys_read exports unused 2007-11-14 18:45:42 -08:00
read_write.h
readdir.c
select.c fs/select, remove unused macros 2007-10-19 11:53:41 -07:00
seq_file.c [FS] seq_file: Introduce the seq_open_private() 2007-10-10 16:55:33 -07:00
signalfd.c rename signalfd_siginfo fields 2007-10-17 08:43:01 -07:00
splice.c Implement file posix capabilities 2007-10-17 08:43:07 -07:00
stack.c
stat.c
super.c Convert files to UTF-8 and some cleanups 2007-10-19 23:21:04 +02:00
sync.c
timerfd.c
utimes.c VFS: check nanoseconds in utimensat 2007-10-17 08:42:52 -07:00
xattr.c [PATCH] pass dentry to audit_inode()/audit_inode_child() 2007-10-21 02:37:18 -04:00
xattr_acl.c