• Eric Biggers's avatar
    fork: fix incorrect fput of ->exe_file causing use-after-free · 2b7e8665
    Eric Biggers authored
    Commit 7c051267 ("mm, fork: make dup_mmap wait for mmap_sem for
    write killable") made it possible to kill a forking task while it is
    waiting to acquire its ->mmap_sem for write, in dup_mmap().
    
    However, it was overlooked that this introduced an new error path before
    a reference is taken on the mm_struct's ->exe_file.  Since the
    ->exe_file of the new mm_struct was already set to the old ->exe_file by
    the memcpy() in dup_mm(), it was possible for the mmput() in the error
    path of dup_mm() to drop a reference to ->exe_file which was never
    taken.
    
    This caused the struct file to later be freed prematurely.
    
    Fix it by updating mm_init() to NULL out the ->exe_file, in the same
    place it clears other things like the list of mmaps.
    
    This bug was found by syzkaller.  It can be reproduced using the
    following C program:
    
        #define _GNU_SOURCE
        #include <pthread.h>
        #include <stdlib.h>
        #include <sys/mman.h>
        #include <sys/syscall.h>
        #include <sys/wait.h>
        #include <unistd.h>
    
        static void *mmap_thread(void *_arg)
        {
            for (;;) {
                mmap(NULL, 0x1000000, PROT_READ,
                     MAP_POPULATE|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
            }
        }
    
        static void *fork_thread(void *_arg)
        {
            usleep(rand() % 10000);
            fork();
        }
    
        int main(void)
        {
            fork();
            fork();
            fork();
            for (;;) {
                if (fork() == 0) {
                    pthread_t t;
    
                    pthread_create(&t, NULL, mmap_thread, NULL);
                    pthread_create(&t, NULL, fork_thread, NULL);
                    usleep(rand() % 10000);
                    syscall(__NR_exit_group, 0);
                }
                wait(NULL);
            }
        }
    
    No special kernel config options are needed.  It usually causes a NULL
    pointer dereference in __remove_shared_vm_struct() during exit, or in
    dup_mmap() (which is usually inlined into copy_process()) during fork.
    Both are due to a vm_area_struct's ->vm_file being used after it's
    already been freed.
    
    Google Bug Id: 64772007
    
    Link: http://lkml.kernel.org/r/20170823211408.31198-1-ebiggers3@gmail.com
    Fixes: 7c051267 ("mm, fork: make dup_mmap wait for mmap_sem for write killable")
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Tested-by: default avatarMark Rutland <mark.rutland@arm.com>
    Acked-by: default avatarMichal Hocko <mhocko@suse.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Konstantin Khlebnikov <koct9i@gmail.com>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: <stable@vger.kernel.org>	[v4.7+]
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    2b7e8665
fork.c 58.7 KB