From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B59F0C07E96 for ; Thu, 8 Jul 2021 11:00:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9304861961 for ; Thu, 8 Jul 2021 11:00:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231553AbhGHLDD (ORCPT ); Thu, 8 Jul 2021 07:03:03 -0400 Received: from vmicros1.altlinux.org ([194.107.17.57]:43156 "EHLO vmicros1.altlinux.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231533AbhGHLDC (ORCPT ); Thu, 8 Jul 2021 07:03:02 -0400 Received: from imap.altlinux.org (imap.altlinux.org [194.107.17.38]) by vmicros1.altlinux.org (Postfix) with ESMTP id 232EC72C8B4; Thu, 8 Jul 2021 14:00:18 +0300 (MSK) Received: from example.org (ip-89-103-72-154.net.upcbroadband.cz [89.103.72.154]) by imap.altlinux.org (Postfix) with ESMTPSA id 91AAA4A46ED; Thu, 8 Jul 2021 14:00:17 +0300 (MSK) Date: Thu, 8 Jul 2021 13:00:16 +0200 From: Alexey Gladkov To: Linus Torvalds Cc: "Eric W. Biederman" , Linux Kernel Mailing List , Linux Containers Subject: Re: [PATCH] ucounts: Fix UCOUNT_RLIMIT_SIGPENDING counter leak Message-ID: <20210708110016.seeviageyspgctzk@example.org> References: <20210702175442.1603082-1-legion@kernel.org> <20210707165008.tym4352uw3hu7uwp@example.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 07, 2021 at 10:23:35AM -0700, Linus Torvalds wrote: > On Wed, Jul 7, 2021 at 9:50 AM Alexey Gladkov wrote: > > > > > + dec_rlimit_ucounts(ucounts, UCOUNT_RLIMIT_SIGPENDING, 1); > > > + fallthrough; > > > + case LONG_MAX: > > > > I think that the counter should be decreased in this case too. > > inc_rlimit_ucounts() increments the counter in all parent userns. If we > > don't decrease the counter then the parent userns will have a counter > > leak. > > Ack. So basically that patch, but move the dec_rlimit_ucounts() into > the LONG_MAX case? Yep. > Would you mind making a real patch with a commit message, and trying > whatever test-case you had for that KASAN use-after-free report? Sure. I will. -- Rgrds, legion