From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754158AbcGSSdg (ORCPT ); Tue, 19 Jul 2016 14:33:36 -0400 Received: from arcturus.aphlor.org ([188.246.204.175]:41006 "EHLO arcturus.aphlor.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753859AbcGSSda (ORCPT ); Tue, 19 Jul 2016 14:33:30 -0400 Date: Tue, 19 Jul 2016 14:33:27 -0400 From: Dave Jones To: Al Viro Cc: Alexey Dobriyan , Linux Kernel Subject: Re: 4.7-rc7: use-after-free in proc_map_files_readdir Message-ID: <20160719183327.GA22621@codemonkey.org.uk> Mail-Followup-To: Dave Jones , Al Viro , Alexey Dobriyan , Linux Kernel References: <20160719153145.GA11224@codemonkey.org.uk> <20160719162036.GG2356@ZenIV.linux.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160719162036.GG2356@ZenIV.linux.org.uk> User-Agent: Mutt/1.6.0 (2016-04-01) X-Spam-Flag: skipped (authorised relay user) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jul 19, 2016 at 05:20:36PM +0100, Al Viro wrote: > On Tue, Jul 19, 2016 at 11:31:45AM -0400, Dave Jones wrote: > > On Tue, Jul 19, 2016 at 02:16:36PM +0300, Alexey Dobriyan wrote: > > > > BUG: KASAN: use-after-free in proc_map_files_readdir+0x2e3/0x5a0 at addr ffff88044feb2044 > > > > > > Just in case can you addr2line this address or post disassembly? > > > > http://codemonkey.org.uk/junk/fs_proc_base.dis.txt > > > > Which by my math, looks to be.. > > > > 7253: 41 8b 87 84 00 00 00 mov 0x84(%r15),%eax > > info.len = snprintf(info.name, > > The entire expression is > info.len = snprintf(info.name, > sizeof(info.name), "%lx-%lx", > vma->vm_start, vma->vm_end); > and we have > * address of array field in local structure. > * constant > * string literal > * two longs fetched from *vma, that being done under ->mmap_sem > * call of snprintf > * store into a field of local structure. > The only ways to get use-after-free in that would be to have *vma freed > under you or have the same happen to your stack frame. > > Could you dump the relevant part of vmlinux objdump, rather than whatever > you've used on base.o? Having relocations resolved makes it much easier > to figure out... Or just dump that vmlinux on anonftp somewhere... http://codemonkey.org.uk/junk/vmlinux.gz Dave