Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns

[Oleg Nesterov <oleg@redhat.com>]

On a second thought...

sched_fork() is called before perf_event_init_task(). So perhaps
sync_child_event() could also check task->__state != TASK_NEW before
perf_event_read_event() ?

Not sure, I know nothing about perf. Would be nice if perf experts can
take a look.

Oleg.

On 01/06, Oleg Nesterov wrote:
>
> On 01/05, Qing Wang wrote:
> >
> > The race condition occurs between the failure path of copy_process() and
> > getting the PIDTYPE_TGID via __task_pid_nr_ns().
> >
> > Bug timeline:
> >                                     Task B
> >                                     perf_event_open()
> > Task A <--------------------------- clone()
> > copy_process()
> >     perf_event_init_task()
> >     ...
> >     one copy failed
> >     free_signal_struct()            close(event_fd)
> >                                         perf_child_detach()
> >                                             __task_pid_nr_ns()
> >                                                 access child task->signal
> 
> Sorry, this description very confusing to me... Is it Task B who does
> clone? Or another Task A does copy_process() ? Could you write a more
> clear changelog?
> 
> >  bad_fork_cleanup_signal:
> > -	if (!(clone_flags & CLONE_THREAD))
> > -		free_signal_struct(p->signal);
> > +	if (!(clone_flags & CLONE_THREAD)) {
> > +		free_sig = p->signal;
> > +		p->signal = NULL;
> > +		free_signal_struct(free_sig);
> > +	}
> >  bad_fork_cleanup_sighand:
> >  	__cleanup_sighand(p->sighand);
> >  bad_fork_cleanup_fs:
> > diff --git a/kernel/pid.c b/kernel/pid.c
> > index a31771bc89c1..1a012e033552 100644
> > --- a/kernel/pid.c
> > +++ b/kernel/pid.c
> > @@ -329,9 +329,9 @@ EXPORT_SYMBOL_GPL(find_vpid);
> >
> >  static struct pid **task_pid_ptr(struct task_struct *task, enum pid_type type)
> >  {
> > -	return (type == PIDTYPE_PID) ?
> > -		&task->thread_pid :
> > -		&task->signal->pids[type];
> > +	if (type == PIDTYPE_PID)
> > +		return &task->thread_pid;
> > +	return task->signal ? &task->signal->pids[type] : NULL;
> >  }
> 
> At first glance this is racy. Can't task->signal be freed right after
> the check?
> 
> And... Can't we make another fix? If copy_process() fails and does
> free_signal_struct(), the child has not been added to rcu protected
> lists and init_task_pid(child) was not called yet.
> 
> So perhaps something like the patch below can work?
> 
> Oleg.
> ---
> 
> --- x/kernel/events/core.c
> +++ x/kernel/events/core.c
> @@ -1422,16 +1422,17 @@ unclone_ctx(struct perf_event_context *c
>  static u32 perf_event_pid_type(struct perf_event *event, struct task_struct *p,
>  				enum pid_type type)
>  {
> -	u32 nr;
> +	u32 nr = 0;
>  	/*
>  	 * only top level events have the pid namespace they were created in
>  	 */
>  	if (event->parent)
>  		event = event->parent;
>  
> -	nr = __task_pid_nr_ns(p, type, event->ns);
> +	if (pid_alive(p))
> +		nr = __task_pid_nr_ns(p, type, event->ns);
>  	/* avoid -1 if it is idle thread or runs in another ns */
> -	if (!nr && !pid_alive(p))
> +	if (!nr)
>  		nr = -1;
>  	return nr;
>  }