From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9280DC00144 for ; Mon, 1 Aug 2022 12:52:54 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CF5376B0071; Mon, 1 Aug 2022 08:52:53 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CA4F36B0072; Mon, 1 Aug 2022 08:52:53 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B6C708E0001; Mon, 1 Aug 2022 08:52:53 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id A75E16B0071 for ; Mon, 1 Aug 2022 08:52:53 -0400 (EDT) Received: from smtpin13.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 68622A5154 for ; Mon, 1 Aug 2022 12:52:53 +0000 (UTC) X-FDA: 79751013426.13.836E558 Received: from sender-of-o53.zoho.in (sender-of-o53.zoho.in [103.117.158.53]) by imf12.hostedemail.com (Postfix) with ESMTP id 3BF3A400EE for ; Mon, 1 Aug 2022 12:52:51 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; t=1659358334; cv=none; d=zohomail.in; s=zohoarc; b=dLCP1LRwIl1bWr8nAoLKsw1Rq7+h63BO/8yjOSVc6ZDf4CcNU138KdA9XBBeAiNcuTLphxxmkBuVD4VvOINKdQlY08JUgW9B71G++jML1beJJ0+8VeEFVnBWYr7rrXgdywf+ITQMynkrkEzaVGfNJgaD94zDC3OzfZ3vqf/LYYs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1659358334; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=ZucGc/xaWsMqpRuxte5cdZ6+7d5BRfDSRyYsk/WnebM=; b=WTkJI9gGhmc2i7zlqK1rCijL1fEd63fgjmGv+CSCky/PpQOK2lDb7THdt51c0DH4DDkutb1V6PRfB3OIBZptJ5OksU7+NVkh/FuDNcijXc05nuj1LhP8JwMkkDkfrTuzONclPHwppoKmqsLtUr7kNGdprp/H3M7I2hdv4CsCsz4= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1659358334; s=zmail; d=siddh.me; i=code@siddh.me; h=Date:Date:From:From:To:To:Cc:Cc:Message-ID:In-Reply-To:References:Subject:Subject:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-Id:Reply-To; bh=ZucGc/xaWsMqpRuxte5cdZ6+7d5BRfDSRyYsk/WnebM=; b=qzQZespJ/Q8jGtl1GDqJIF5aC+wrNQOdlAjDIZ1rQ+rFaF0kP9Jgya4nD+YWbST/ 7uJSeO1mAuzwfoGYwA1crDvg+m2MbKcSf3kDCrSWnz/FpbQ/JfDQR0JVXVy3O7hcROW yYoU2p3xKikOAq0SK9+/hKqakcM6fvJffR9VzMXE= Received: from mail.zoho.in by mx.zoho.in with SMTP id 1659358322294738.2309151863757; Mon, 1 Aug 2022 18:22:02 +0530 (IST) Date: Mon, 01 Aug 2022 18:22:02 +0530 From: Siddh Raman Pant To: "hdanton" Cc: "linux-kernel" , "linux-mm" , "Dipanjan Das" , "David Howells" , "Greg KH" , "Christophe JAILLET" , "Eric Dumazet" , "Fabio M. De Francesco" , "linux-security-modules" , "linux-kernel-mentees" , "syzbot+c70d87ac1d001f29a058" , "Marius Fleischer" , "Priyanka Bose" Message-ID: <18259769e5e.52eb2082293078.3991591702430862151@siddh.me> In-Reply-To: <20220801121513.28E4B5204D1@webmail.sinamail.sina.com.cn> References: <20220801121513.28E4B5204D1@webmail.sinamail.sina.com.cn> Subject: Re: [PATCH] kernel/watch_queue: Make pipe NULL while clearing watch_queue MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Importance: Medium User-Agent: Zoho Mail X-Mailer: Zoho Mail ARC-Authentication-Results: i=2; imf12.hostedemail.com; dkim=pass header.d=siddh.me header.s=zmail header.b=qzQZespJ; arc=pass ("zohomail.in:s=zohoarc:i=1"); spf=pass (imf12.hostedemail.com: domain of code@siddh.me designates 103.117.158.53 as permitted sender) smtp.mailfrom=code@siddh.me; dmarc=pass (policy=reject) header.from=siddh.me ARC-Seal: i=2; s=arc-20220608; d=hostedemail.com; t=1659358373; a=rsa-sha256; cv=pass; b=71Tjz1CLJLiz204Ktu0KzYSN9cNSOaC3+qlnvQUvk1Vid9rQjD05Hb8FolSlyugfvBN5SX UkQ4cOIobxPR63mXTSg2haGlEQlkTeSed71Vy++lXACA8lzCa4MbI+QFgaOcmCx5h9TAka UQfd6V92FNJ68MnKktb1bW9fAKa4ux0= ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1659358373; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ZucGc/xaWsMqpRuxte5cdZ6+7d5BRfDSRyYsk/WnebM=; b=iyT0LwVeSmBge6op4JvKdQQDQnsFiE6CQMn0ZjluVx9ZLutKKBbir5TZNWbXLfS+Vx+jp1 P37TGBGRM4xdOLClXeCBZyXD6NRqMGPbT1I40AqLp3QxHLlYuDD8chh+VmBJGL9Fyyl7C1 fBC/Pgsf13ZiTVjb3/V7Tx5JoAK3Fq8= Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=siddh.me header.s=zmail header.b=qzQZespJ; arc=pass ("zohomail.in:s=zohoarc:i=1"); spf=pass (imf12.hostedemail.com: domain of code@siddh.me designates 103.117.158.53 as permitted sender) smtp.mailfrom=code@siddh.me; dmarc=pass (policy=reject) header.from=siddh.me X-Stat-Signature: gwanr618fz3e7mcba7bifbrmo49hn7y3 X-Rspamd-Queue-Id: 3BF3A400EE X-Rspam-User: X-Rspamd-Server: rspam07 X-HE-Tag: 1659358371-532318 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, 01 Aug 2022 17:45:13 +0530 Hillf Danton wrote: > What is not clear is what you are fixing, with CVE-2022-1882 put aside, > given the mainline tree survived the syzbot test [1] irrespective of > other fixing efforts [2, 3]. > > Hillf > > [1] https://lore.kernel.org/lkml/000000000000c7a83905e52bd127@google.com/ > > // syzbot has tested the proposed patch and the reproducer did not trigger any issue: > // > // Reported-and-tested-by: syzbot+c70d87ac1d001f29a058@syzkaller.appspotmail.com > // > // Tested on: > // > // commit: 3d7cb6b0 Linux 5.19 > // git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master > // console output: https://syzkaller.appspot.com/x/log.txt?x=14066d7a080000 > // kernel config: https://syzkaller.appspot.com/x/.config?x=70dd99d568a89e0 > // dashboard link: https://syzkaller.appspot.com/bug?extid=c70d87ac1d001f29a058 > // compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > // > // Note: no patches were applied. > // Note: testing is done by a robot and is best-effort only. > > [2] https://lore.kernel.org/lkml/0000000000000dac0205e479ea39@google.com/ > > [3] https://lore.kernel.org/lkml/00000000000014c7ad05e4d535fc@google.com/ > (Fixed broken formatting) This bug is about watch_queue still having a reference to a freed pipe, which was being accessed by post_one_notification() at the time of when I posted the v1 patch for fixing it on 23rd July, by removing the reference to the freed pipe in the watch_queue. Given ref. [3] by you leads to a bug about UAF in __post_watch_notification(): https://syzkaller.appspot.com/bug?extid=03d7b43290037d1f87ca That bug is fixed by the following commit by David Howells on 28th July: e64ab2dbd882 ("watch_queue: Fix missing locking in add_watch_to_object()") https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e64ab2dbd882933b65cd82ff6235d705ad65dbb6 Given ref. [2] by you is of a patch tested by you, which can be found below: https://groups.google.com/g/syzkaller-bugs/c/RbmAFTAIuyY/m/-vMjf-BXAQAJ This had overlooked the existing serialization of wqueue->defunct, which you had yourself pointed out in the reply to v2, which can be found below: https://lore.kernel.org/linux-kernel-mentees/20220724071958.2557-1-hdanton@sina.com/ Given ref. [1] by you is about a syzbot test which was ran today, which no longer triggers the issue. This probably happens due to the commit by David Howells referenced earlier by me. While it does cause the reproducer to fail, it doesn't really fix the particular issue concerned by this patch, which is that the watch_queue has a reference to a freed pipe, which had caused a UAF. Hope everything is clear. Thanks, Siddh