All of lore.kernel.org
 help / color / mirror / Atom feed
From: Siddh Raman Pant via Linux-kernel-mentees <linux-kernel-mentees@lists.linuxfoundation.org>
To: David Howells <dhowells@redhat.com>,
	Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
	Eric Dumazet <edumazet@google.com>,
	"Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc: linux-security-modules <linux-security-module@vger.kernel.org>,
	linux-kernel-mentees
	<linux-kernel-mentees@lists.linuxfoundation.org>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com
Subject: [PATCH v2] kernel/watch_queue: Make pipe NULL while clearing watch_queue
Date: Sun, 24 Jul 2022 09:32:40 +0530	[thread overview]
Message-ID: <20220724040240.7842-1-code@siddh.me> (raw)

If not done, a reference to a freed pipe remains in the watch_queue,
as this function is called before freeing a pipe in free_pipe_info()
(see line 834 of fs/pipe.c).

This causes a UAF when post_one_notification tries to access the pipe on
a key update, which is reported by syzbot.

Bug report: https://syzkaller.appspot.com/bug?id=1870dd7791ba05f2ea7f47f7cbdde701173973fc
Reported-and-tested-by: syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com

Signed-off-by: Siddh Raman Pant <code@siddh.me>
---
Changes since v1:
- Removed the superfluous ifdef guard.

 kernel/watch_queue.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index bb9962b33f95..0357e5c6cf18 100644
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -637,8 +637,15 @@ void watch_queue_clear(struct watch_queue *wqueue)
 		spin_lock_bh(&wqueue->lock);
 	}
 
-	spin_unlock_bh(&wqueue->lock);
 	rcu_read_unlock();
+
+	/* Clearing the watch queue, so we should clean the associated pipe. */
+	if (wqueue->pipe) {
+		wqueue->pipe->watch_queue = NULL;
+		wqueue->pipe = NULL;
+	}
+
+	spin_unlock_bh(&wqueue->lock);
 }
 
 /**
-- 
2.35.1


_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees

WARNING: multiple messages have this Message-ID (diff)
From: Siddh Raman Pant <code@siddh.me>
To: David Howells <dhowells@redhat.com>,
	Christophe JAILLET <christophe.jaillet@wanadoo.fr>,
	Eric Dumazet <edumazet@google.com>,
	"Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc: linux-security-modules <linux-security-module@vger.kernel.org>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	linux-kernel-mentees 
	<linux-kernel-mentees@lists.linuxfoundation.org>,
	syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com
Subject: [PATCH v2] kernel/watch_queue: Make pipe NULL while clearing watch_queue
Date: Sun, 24 Jul 2022 09:32:40 +0530	[thread overview]
Message-ID: <20220724040240.7842-1-code@siddh.me> (raw)

If not done, a reference to a freed pipe remains in the watch_queue,
as this function is called before freeing a pipe in free_pipe_info()
(see line 834 of fs/pipe.c).

This causes a UAF when post_one_notification tries to access the pipe on
a key update, which is reported by syzbot.

Bug report: https://syzkaller.appspot.com/bug?id=1870dd7791ba05f2ea7f47f7cbdde701173973fc
Reported-and-tested-by: syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com

Signed-off-by: Siddh Raman Pant <code@siddh.me>
---
Changes since v1:
- Removed the superfluous ifdef guard.

 kernel/watch_queue.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c
index bb9962b33f95..0357e5c6cf18 100644
--- a/kernel/watch_queue.c
+++ b/kernel/watch_queue.c
@@ -637,8 +637,15 @@ void watch_queue_clear(struct watch_queue *wqueue)
 		spin_lock_bh(&wqueue->lock);
 	}
 
-	spin_unlock_bh(&wqueue->lock);
 	rcu_read_unlock();
+
+	/* Clearing the watch queue, so we should clean the associated pipe. */
+	if (wqueue->pipe) {
+		wqueue->pipe->watch_queue = NULL;
+		wqueue->pipe = NULL;
+	}
+
+	spin_unlock_bh(&wqueue->lock);
 }
 
 /**
-- 
2.35.1



             reply	other threads:[~2022-07-24  4:03 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-24  4:02 Siddh Raman Pant via Linux-kernel-mentees [this message]
2022-07-24  4:02 ` [PATCH v2] kernel/watch_queue: Make pipe NULL while clearing watch_queue Siddh Raman Pant
     [not found] <20220724052426.2504-1-hdanton@sina.com>
2022-07-24  6:26 ` Siddh Raman Pant via Linux-kernel-mentees
2022-07-24  6:26   ` Siddh Raman Pant
2022-07-24  7:19   ` Hillf Danton
2022-07-24  7:48     ` Siddh Raman Pant via Linux-kernel-mentees
2022-07-24  7:48       ` Siddh Raman Pant
2022-07-27 14:49     ` David Howells
2022-07-27 14:49       ` David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220724040240.7842-1-code@siddh.me \
    --to=linux-kernel-mentees@lists.linuxfoundation.org \
    --cc=christophe.jaillet@wanadoo.fr \
    --cc=code@siddh.me \
    --cc=dhowells@redhat.com \
    --cc=edumazet@google.com \
    --cc=fmdefrancesco@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.