Re: [PATCH] pstore: Fix uaf when backend is unregistered

[Zach Wade]

On 2024/10/9 21:36, Zach Wade wrote:
> On 2024/10/9 1:23, Kees Cook wrote:
> > On Wed, Oct 09, 2024 at 01:10:14AM +0800, Zach Wade wrote:
> > > when unload pstore_blk, we will unlink the pstore file and
> > > set pos->dentry to NULL, but simple_unlink(d_inode(root), pos->dentry)
> > > may free inode of pos->dentry and free pos by free_pstore_private,
> > > this may trigger uaf. kasan report:
> >
> > Thanks for this! I need to double check what happening here a bit more
> > closely, as maybe some ordering changed after a43e0fc5e913 ("pstore:
> > inode: Only d_invalidate() is needed")
> >
> > > @@ -316,9 +316,10 @@ int pstore_put_backend_records(struct 
> > > pstore_info *psi)
> > >           list_for_each_entry_safe(pos, tmp, &records_list, list) {
> > >               if (pos->record->psi == psi) {
> > >                   list_del_init(&pos->list);
> > > -                d_invalidate(pos->dentry);
> > > -                simple_unlink(d_inode(root), pos->dentry);
> > > +                unlink_dentry = pos->dentry;
> > >                   pos->dentry = NULL;
> > > +                d_invalidate(unlink_dentry);
> > > +                simple_unlink(d_inode(root), unlink_dentry);
> >
> > But on the face of it, this does solve the UAF. I'll double-check that
> > this isn't a result of the mentioned commit.
>
> Hi Cook,
>
> However, I think a more appropriate solution to the problem here is to
> check the reference count when uninstalling the mount point.
>
> At the same time, the test script is attached:
> #!/bin/bash
> modprobe pstore_blk
> blkdev=/dev/sda2
> best_effort=on
> mount -t pstore pstore /sys/fs/pstore
> sleep 2
> umount /sys/fs/pstore
> modprobe -r pstore_blk
>
> Thanks,
> Zach
>
> >
>
> > -Kees

friendly ping.

Hi Cook,

How are you doing? I really hope we can solve this problem.

Thanks,
Zach