Bug 98301
| Summary: | Kernel null pointer dereference when sandboxing | ||
|---|---|---|---|
| Product: | Other | Reporter: | Steven Stewart-Gallus (sstewartgallus00) |
| Component: | Other | Assignee: | other_other |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | CC: | luto |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 4.0.2 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
|
Description
Steven Stewart-Gallus
2015-05-13 21:38:18 UTC
The bug still occurs on Linux 4.04. Also, I took a picture of the backtrace that shows up on the console my phone. The information on the screen says the NULL dereference occurs at pin_remove. It also shows a backtrace of drop_mountpoint pin_kill ? woken_wake_function mnt_pin_kill cleanup_mnt __cleanup_mnt task_work_run do_notify_resume int_signal This appears to be the same or a similar bug as described at http://permalink.gmane.org/gmane.linux.kernel.containers/29340 Rereading over information on how to submit bug reports I found that I should record the output of the script ./scripts/ver_linux. It gives: Linux proteus 4.0.4-gnu #1 SMP Mon May 18 12:12:23 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux Gnu C 4.8 Gnu make 3.81 binutils 2.24 util-linux 2.20.1 mount support module-init-tools 15 e2fsprogs 1.42.9 jfsutils 1.1.15 reiserfsprogs 3.6.24 reiser4progs 1.0.7 xfsprogs 3.1.9 pcmciautils 018 quota-tools 4.01. PPP 2.4.5 Linux C Library 2.19 Dynamic linker (ldd) 2.19 Procps 3.3.9 Net-tools 1.60 Kbd 1.15.5 oprofile 0.9.9 Sh-utils 8.21 wireless-tools 30 Modules Loaded uas usb_storage ctr ccm bnep rfcomm binfmt_misc intel_rapl intel_soc_dts_thermal intel_powerclamp coretemp snd_hda_codec_hdmi snd_hda_codec_realtek joydev ath3k kvm_intel snd_hda_codec_generic btusb acer_wmi snd_hda_intel sparse_keymap snd_hda_controller bluetooth snd_hda_codec kvm snd_hwdep snd_pcm hid_multitouch arc4 crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_seq_midi ath9k snd_seq_midi_event uvcvideo ath9k_common ath9k_hw snd_rawmidi dm_multipath videobuf2_vmalloc ath videobuf2_memops videobuf2_core snd_seq mac80211 scsi_dh v4l2_common snd_seq_device cfg80211 videodev snd_timer media snd iosf_mbi cryptd soundcore serio_raw lpc_ich shpchp mei_txe 8250_fintek mei dw_dmac dw_dmac_core int3400_thermal processor_thermal_device int3403_thermal intel_smartconnect acpi_thermal_rel int340x_thermal_zone i2c_hid pwm_lpss_platform pwm_lpss spi_pxa2xx_platform i2c_designware_platform i2c_designware_core mac_hid nls_iso8859_1 parport_pc ppdev lp parport btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq raid1 raid0 multipath linear dm_mirror dm_region_hash dm_log hid_generic usbhid hid i915 i2c_algo_bit r8169 drm_kms_helper ahci mii libahci drm wmi video This was introduced in 4.0.2 and is fixed by: commit 820f9f147dcce2602eefd9b575bbbd9ea14f0953 Author: Eric W. Biederman <ebiederm@xmission.com> Date: Thu Apr 2 16:35:48 2015 -0500 fs_pin: Allow for the possibility that m_list or s_list go unused. This is needed to support lazily umounting locked mounts. Because the entire unmounted subtree needs to stay together until there are no users with references to any part of the subtree. To support this guarantee that the fs_pin m_list and s_list nodes are initialized by initializing them in init_fs_pin allowing for the possibility that pin_insert_group does not touch them. Further use hlist_del_init in pin_remove so that there is a hlist_unhashed test before the list we attempt to update the previous list item. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> commit cd4a40174b71acd021877341684d8bb1dc8ea4ae Author: Eric W. Biederman <ebiederm@xmission.com> Date: Wed Jan 7 14:28:26 2015 -0600 mnt: Fail collect_mounts when applied to unmounted mounts The only users of collect_mounts are in audit_tree.c In audit_trim_trees and audit_add_tree_rule the path passed into collect_mounts is generated from kern_path passed an audit_tree pathname which is guaranteed to be an absolute path. In those cases collect_mounts is obviously intended to work on mounted paths and if a race results in paths that are unmounted when collect_mounts it is reasonable to fail early. The paths passed into audit_tag_tree don't have the absolute path check. But are used to play with fsnotify and otherwise interact with the audit_trees, so again operating only on mounted paths appears reasonable. Avoid having to worry about what happens when we try and audit unmounted filesystems by restricting collect_mounts to mounts that appear in the mount tree. Can confirm this bug is fixed. |