From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751453AbdH1PzN (ORCPT <rfc822;w@1wt.eu>);
        Mon, 28 Aug 2017 11:55:13 -0400
Received: from mail-io0-f194.google.com ([209.85.223.194]:36400 "EHLO
        mail-io0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751300AbdH1PzK (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 28 Aug 2017 11:55:10 -0400
Date: Mon, 28 Aug 2017 10:55:06 -0500
From: Eric Biggers <ebiggers3@gmail.com>
To: Oleg Nesterov <oleg@redhat.com>
Cc: linux-mm@kvack.org, Andrew Morton <akpm@linux-foundation.org>,
        linux-kernel@vger.kernel.org, Dmitry Vyukov <dvyukov@google.com>,
        Ingo Molnar <mingo@kernel.org>,
        Konstantin Khlebnikov <koct9i@gmail.com>,
        Michal Hocko <mhocko@suse.com>, Peter Zijlstra <peterz@infradead.org>,
        Vlastimil Babka <vbabka@suse.cz>, stable@vger.kernel.org,
        Eric Biggers <ebiggers@google.com>
Subject: Re: [PATCH] fork: fix incorrect fput of ->exe_file causing
 use-after-free
Message-ID: <20170828155506.GA531@zzz.localdomain>
References: <20170823211408.31198-1-ebiggers3@gmail.com>
 <20170824132041.GA22882@redhat.com>
 <20170824165935.GA21624@gmail.com>
 <20170825144036.GA26620@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170825144036.GA26620@redhat.com>
User-Agent: Mutt/1.8.3 (2017-05-23)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Aug 25, 2017 at 04:40:36PM +0200, Oleg Nesterov wrote:
> On 08/24, Eric Biggers wrote:
> >
> > On Thu, Aug 24, 2017 at 03:20:41PM +0200, Oleg Nesterov wrote:
> > > On 08/23, Eric Biggers wrote:
> > > >
> > > > From: Eric Biggers <ebiggers@google.com>
> > > >
> > > > Commit 7c051267931a ("mm, fork: make dup_mmap wait for mmap_sem for
> > > > write killable") made it possible to kill a forking task while it is
> > > > waiting to acquire its ->mmap_sem for write, in dup_mmap().  However, it
> > > > was overlooked that this introduced an new error path before a reference
> > > > is taken on the mm_struct's ->exe_file.
> > >
> > > Hmm. Unless I am totally confused, the same problem with mm->exol_area?
> > > I'll recheck....
> >
> > I'm not sure what you mean by ->exol_area.
> 
> I meant mm->uprobes_state.xol_area, sorry
> 

Yep, that's a bug too.  I was able to cause a use-after-free using the same
reproducer program I gave in my commit message, after setting a uprobe
tracepoint on the beginning of the fork_thread() function.  I'll send a patch to
fix it when I have a chance.

Eric