Re: out-of-bounds in pid_nr_ns() due to "proc: modernize proc to support multiple private instances"

[Alexey Gladkov]

On Thu, Apr 23, 2020 at 04:11:48PM -0400, Qian Cai wrote:
> Eric, Stephen, can you pull out this series while Alexey is getting to the bottom of this slab-out-of-bounds?

Hi! I fixed this in the new version (v13) of my patch set.

https://lore.kernel.org/lkml/20200423200316.164518-1-gladkov.alexey@xxxxxxxxx/

> > On Apr 22, 2020, at 3:35 PM, Qian Cai <cai@xxxxxx> wrote:
> > 
> > Reverted the whole series from linux-next,
> > 
> > 20d3928579da proc: use named enums for better readability
> > e9fc842e1fb6 proc: use human-readable values for hidepid
> > 3ef9b8afc054 docs: proc: add documentation for "hidepid=4" and "subset=pid" options and new mount behavior
> > f1031df957fa proc: add option to mount only a pids subset
> > 9153c0921a1e proc: instantiate only pids that we can ptrace on 'hidepid=4' mount option
> > 1ef97cee07dd proc: allow to mount many instances of proc in one pid namespace
> > 39f8e6256b4b proc: rename struct proc_fs_info to proc_fs_opts 
> > 
> > fixed out-of-bounds in pid_nr_ns() while reading proc files.
> > 
> > === arm64 ===
> > [12140.366814] LTP: starting proc01 (proc01 -m 128)
> > [12149.580943] ==================================================================
> > [12149.589521] BUG: KASAN: out-of-bounds in pid_nr_ns+0x2c/0x90
> > pid_nr_ns at kernel/pid.c:456
> > [12149.595939] Read of size 4 at addr 1bff000bfa8c0388 by task proc01/50298
> > [12149.603392] Pointer tag: [1b], memory tag: [fe]
> > 
> > [12149.610906] CPU: 69 PID: 50298 Comm: proc01 Tainted: G             L    5.7.0-rc2-next-20200422 #6
> > [12149.620585] Hardware name: HPE Apollo 70             /C01_APACHE_MB         , BIOS L50_5.13_1.11 06/18/2019
> > [12149.631074] Call trace:
> > [12149.634304]  dump_backtrace+0x0/0x22c
> > [12149.638745]  show_stack+0x28/0x34
> > [12149.642839]  dump_stack+0x104/0x194
> > [12149.647110]  print_address_description+0x70/0x3a4
> > [12149.652576]  __kasan_report+0x188/0x238
> > [12149.657169]  kasan_report+0x3c/0x58
> > [12149.661430]  check_memory_region+0x98/0xa0
> > [12149.666303]  __hwasan_load4_noabort+0x18/0x20
> > [12149.671431]  pid_nr_ns+0x2c/0x90
> > [12149.675446]  locks_translate_pid+0xf4/0x1a0
> > [12149.680382]  locks_show+0x68/0x110
> > [12149.684536]  seq_read+0x380/0x930
> > [12149.688604]  pde_read+0x5c/0x78
> > [12149.692498]  proc_reg_read+0x74/0xc0
> > [12149.696813]  __vfs_read+0x84/0x1d0
> > [12149.700939]  vfs_read+0xec/0x124
> > [12149.704889]  ksys_read+0xb0/0x120
> > [12149.708927]  __arm64_sys_read+0x54/0x88
> > [12149.713485]  do_el0_svc+0x128/0x1dc
> > [12149.717697]  el0_sync_handler+0x150/0x250
> > [12149.722428]  el0_sync+0x164/0x180
> > 
> > [12149.728672] Allocated by task 1:
> > [12149.732624]  __kasan_kmalloc+0x124/0x188
> > [12149.737269]  kasan_kmalloc+0x10/0x18
> > [12149.741568]  kmem_cache_alloc_trace+0x2e4/0x3d4
> > [12149.746820]  proc_fill_super+0x48/0x1fc
> > [12149.751377]  vfs_get_super+0xcc/0x170
> > [12149.755760]  get_tree_nodev+0x28/0x34
> > [12149.760143]  proc_get_tree+0x24/0x30
> > [12149.764439]  vfs_get_tree+0x54/0x158
> > [12149.768736]  do_mount+0x80c/0xaf0
> > [12149.772774]  __arm64_sys_mount+0xe0/0x18c
> > [12149.777504]  do_el0_svc+0x128/0x1dc
> > [12149.781715]  el0_sync_handler+0x150/0x250
> > [12149.786445]  el0_sync+0x164/0x180
> > 
> > [12149.792687] Freed by task 0:
> > [12149.796285] (stack is not available)
> > 
> > [12149.802792] The buggy address belongs to the object at ffff000bfa8c0300
> >                which belongs to the cache kmalloc-128 of size 128
> > [12149.816727] The buggy address is located 8 bytes to the right of
> >                128-byte region [ffff000bfa8c0300, ffff000bfa8c0380)
> > [12149.830223] The buggy address belongs to the page:
> > [12149.835740] page:ffffffe002dea300 refcount:1 mapcount:0 mapping:0000000037c9e9b5 index:0x31ff000bfa8c9e00
> > [12149.846027] flags: 0x5ffffffe000200(slab)
> > [12149.850765] raw: 005ffffffe000200 ffffffe022175788 ffffffe02215b788 17ff0087a0020480
> > [12149.859232] raw: 31ff000bfa8c9e00 0000000000660065 00000001ffffffff 0000000000000000
> > [12149.867693] page dumped because: kasan: bad access detected
> > [12149.873984] page_owner tracks the page as allocated
> > [12149.879585] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY)
> > [12149.891438]  post_alloc_hook+0x94/0xd4
> > [12149.895908]  prep_new_page+0x34/0xcc
> > [12149.900206]  get_page_from_freelist+0x4c4/0x60c
> > [12149.905458]  __alloc_pages_nodemask+0x1c0/0x2e8
> > [12149.910712]  alloc_page_interleave+0x38/0x18c
> > [12149.915791]  alloc_pages_current+0x80/0xe0
> > [12149.920610]  alloc_slab_page+0x154/0x3b4
> > [12149.925254]  new_slab+0xc8/0x5f4
> > [12149.929203]  ___slab_alloc+0x248/0x440
> > [12149.933675]  kmem_cache_alloc_trace+0x368/0x3d4
> > [12149.938928]  ftrace_free_mem+0x258/0x7ac
> > [12149.943575]  ftrace_free_init_mem+0x20/0x28
> > [12149.948482]  kernel_init+0x1c/0x204
> > [12149.952692]  ret_from_fork+0x10/0x18
> > [12149.956986] page_owner free stack trace missing
> > 
> > [12149.964443] Memory state around the buggy address:
> > [12149.969956]  ffff000bfa8c0100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> > [12149.977899]  ffff000bfa8c0200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> > [12149.985841] >ffff000bfa8c0300: 1b 1b 1b fe fe fe fe fe fe fe fe fe fe fe fe fe
> > [12149.993781]                                            ^
> > [12149.999814]  ffff000bfa8c0400: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
> > [12150.007757]  ffff000bfa8c0500: fe fe fe fe fe fe fe fe 6c 6c 6c 6c 6c 6c 6c 6c
> > [12150.015697] ==================================================================
> > [12150.023638] Disabling lock debugging due to kernel taint
> > 
> > === s390 ===
> > [14452.527006] LTP: starting proc01 (proc01 -m 128)
> > [14455.663026] ==================================================================
> > [14455.664078] BUG: KASAN: slab-out-of-bounds in pid_nr_ns+0x34/0xa8
> > [14455.664120] Read of size 4 at addr 000000000dabacc8 by task proc01/41628
> > 
> > [14455.664205] CPU: 1 PID: 41628 Comm: proc01 Not tainted 5.7.0-rc2-next-20200422 #2
> > [14455.664248] Hardware name: IBM 2964 N96 400 (z/VM 6.4.0)
> > [14455.664288] Call Trace:
> > [14455.664335]  [<00000000084be28a>] show_stack+0x11a/0x1c8 
> > [14455.664382]  [<0000000008b147f4>] dump_stack+0x134/0x180 
> > [14455.664434]  [<00000000088b56c4>] print_address_description.isra.9+0x5c/0x3e8 
> > [14455.664480]  [<00000000088b5cac>] __kasan_report+0x114/0x140 
> > [14455.664523]  [<00000000088b4bf4>] kasan_report+0x4c/0x58 
> > [14455.666150]  [<0000000008532a24>] pid_nr_ns+0x34/0xa8 
> > [14455.666203]  [<00000000089ee806>] locks_translate_pid+0xee/0x1c8 
> > [14455.666246]  [<00000000089eeea4>] locks_show+0x84/0x130 
> > [14455.666295]  [<0000000008958c3e>] seq_read+0x25e/0x7f0 
> > [14455.666343]  [<0000000008a14e70>] proc_reg_read+0x100/0x168 
> > [14455.666389]  [<000000000890fa22>] vfs_read+0x92/0x150 
> > [14455.666432]  [<000000000890feda>] ksys_read+0xe2/0x188 
> > [14455.666483]  [<0000000008e671d0>] system_call+0xd8/0x2b4 
> > [14455.666525] 5 locks held by proc01/41628:
> > [14455.666562]  #0: 000000003e0e0c10 (&p->lock){+.+.}-{3:3}, at: seq_read+0x5e/0x7f0
> > [14455.666630]  #1: 00000000095deff0 (file_rwsem){++++}-{0:0}, at: locks_start+0x66/0x98
> > [14455.666695]  #2: 00000000095deed8 (blocked_lock_lock){+.+.}-{2:2}, at: locks_start+0x72/0x98
> > [14455.673879]  #3: 0000000009393b60 (rcu_read_lock){....}-{1:2}, at: locks_translate_pid+0x5e/0x1c8
> > [14455.673967]  #4: 00000000095367d0 (report_lock){....}-{2:2}, at: __kasan_report+0x6e/0x140
> > 
> > [14455.674077] Allocated by task 1:
> > [14455.674128]  stack_trace_save+0xba/0xd0
> > [14455.674169]  save_stack+0x30/0x58
> > [14455.674211]  __kasan_kmalloc.isra.19+0xd4/0xe8
> > [14455.674253]  kmem_cache_alloc_trace+0x246/0x390
> > [14455.674296]  proc_fill_super+0x60/0x2e0
> > [14455.674339]  vfs_get_super+0x10a/0x1a8
> > [14455.674379]  vfs_get_tree+0x5e/0x158
> > [14455.674424]  do_mount+0xbd2/0xe28
> > [14455.674465]  __s390x_sys_mount+0xe2/0xf8
> > [14455.674509]  system_call+0xd8/0x2b4
> > 
> > [14455.674582] Freed by task 1:
> > [14455.674622]  stack_trace_save+0xba/0xd0
> > [14455.674663]  save_stack+0x30/0x58
> > [14455.674704]  __kasan_slab_free+0x130/0x198
> > [14455.674745]  slab_free_freelist_hook+0x7a/0x240
> > [14455.674786]  kfree+0x10a/0x508
> > [14455.674831]  __kthread_create_on_node+0x206/0x2f0
> > [14455.674873]  kthread_create_on_node+0xa0/0xb8
> > [14455.674915]  init_rescuer.part.13+0x66/0xf8
> > [14455.674966]  workqueue_init+0x40e/0x658
> > [14455.675010]  kernel_init_freeable+0x21e/0x590
> > [14455.675056]  kernel_init+0x22/0x180
> > [14455.675096]  ret_from_fork+0x30/0x34
> > 
> > [14455.675296] The buggy address belongs to the object at 000000000dabac40
> >                which belongs to the cache kmalloc-64 of size 64
> > [14455.675345] The buggy address is located 72 bytes to the right of
> >                64-byte region [000000000dabac40, 000000000dabac80)
> > [14455.675391] The buggy address belongs to the page:
> > [14455.675441] page:000003d08036ae80 refcount:1 mapcount:0 mapping:00000000c06a91d7 index:0xdabae40
> > [14455.675489] flags: 0x1fffe00000000200(slab)
> > [14455.675536] raw: 1fffe00000000200 000003d0817ad788 000003d080c04908 000000000ff8c600
> > [14455.675582] raw: 000000000dabae40 0006001000000000 ffffffff00000001 0000000000000000
> > [14455.675624] page dumped because: kasan: bad access detected
> > [14455.675666] page_owner tracks the page as allocated
> > [14455.675707] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0()
> > [14455.675753]  stack_trace_save+0xba/0xd0
> > [14455.675797]  register_early_stack+0x8c/0xb8
> > [14455.675840]  init_page_owner+0x60/0x510
> > [14455.675881]  kernel_init_freeable+0x278/0x590
> > [14455.675919] page_owner free stack trace missing
> > 
> > [14455.675993] Memory state around the buggy address:
> > [14455.676034]  000000000dabab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > [14455.676078]  000000000dabac00: fc fc fc fc fc fc fc fc 00 00 00 00 00 fc fc fc
> > [14455.676122] >000000000dabac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > [14455.676171]                                               ^
> > [14455.676213]  000000000dabad00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > [14455.676257]  000000000dabad80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > [14455.676299] ==================================================================
> > [14455.676339] Disabling lock debugging due to kernel taint
> > 
> > 
> 

-- 
Rgrds, legion