There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.
Cc: Brendan Higgins <[email protected]>
Cc: David Gow <[email protected]>
Cc: Rae Moar <[email protected]>
Cc: Shuah Khan <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Signed-off-by: Mickaël Salaün <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
---
Changes since v1:
* Added Kees's Reviewed-by.
---
lib/kunit/try-catch.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
index a5cb2ef70a25..73f5007f20ea 100644
--- a/lib/kunit/try-catch.c
+++ b/lib/kunit/try-catch.c
@@ -11,6 +11,7 @@
#include <linux/completion.h>
#include <linux/kernel.h>
#include <linux/kthread.h>
+#include <linux/sched/task.h>
#include "try-catch-impl.h"
@@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
try_catch->context = context;
try_catch->try_completion = &try_completion;
try_catch->try_result = 0;
- task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
- try_catch,
- "kunit_try_catch_thread");
+ task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
+ try_catch, "kunit_try_catch_thread");
if (IS_ERR(task_struct)) {
try_catch->try_result = PTR_ERR(task_struct);
try_catch->catch(try_catch->context);
return;
}
+ get_task_struct(task_struct);
+ wake_up_process(task_struct);
time_remaining = wait_for_completion_timeout(&try_completion,
kunit_test_timeout());
@@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
kthread_stop(task_struct);
}
+ put_task_struct(task_struct);
exit_code = try_catch->try_result;
if (!exit_code)
--
2.44.0
On Fri, Mar 1, 2024 at 2:40 PM Mickaël Salaün <[email protected]> wrote:
>
> There is a race condition when a kthread finishes after the deadline and
> before the call to kthread_stop(), which may lead to use after free.
Hello!
I have tested this patch and it looks good to me.
Thanks!
-Rae
Reviewed-by: Rae Moar <[email protected]>
>
> Cc: Brendan Higgins <[email protected]>
> Cc: David Gow <[email protected]>
> Cc: Rae Moar <[email protected]>
> Cc: Shuah Khan <[email protected]>
> Reviewed-by: Kees Cook <[email protected]>
> Signed-off-by: Mickaël Salaün <[email protected]>
> Link: https://lore.kernel.org/r/[email protected]
> ---
>
> Changes since v1:
> * Added Kees's Reviewed-by.
> ---
> lib/kunit/try-catch.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
> index a5cb2ef70a25..73f5007f20ea 100644
> --- a/lib/kunit/try-catch.c
> +++ b/lib/kunit/try-catch.c
> @@ -11,6 +11,7 @@
> #include <linux/completion.h>
> #include <linux/kernel.h>
> #include <linux/kthread.h>
> +#include <linux/sched/task.h>
>
> #include "try-catch-impl.h"
>
> @@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
> try_catch->context = context;
> try_catch->try_completion = &try_completion;
> try_catch->try_result = 0;
> - task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
> - try_catch,
> - "kunit_try_catch_thread");
> + task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
> + try_catch, "kunit_try_catch_thread");
> if (IS_ERR(task_struct)) {
> try_catch->try_result = PTR_ERR(task_struct);
> try_catch->catch(try_catch->context);
> return;
> }
> + get_task_struct(task_struct);
> + wake_up_process(task_struct);
>
> time_remaining = wait_for_completion_timeout(&try_completion,
> kunit_test_timeout());
> @@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
> kthread_stop(task_struct);
> }
>
> + put_task_struct(task_struct);
> exit_code = try_catch->try_result;
>
> if (!exit_code)
> --
> 2.44.0
>
On Sat, 2 Mar 2024 at 03:40, Mickaël Salaün <[email protected]> wrote:
>
> There is a race condition when a kthread finishes after the deadline and
> before the call to kthread_stop(), which may lead to use after free.
>
> Cc: Brendan Higgins <[email protected]>
> Cc: David Gow <[email protected]>
> Cc: Rae Moar <[email protected]>
> Cc: Shuah Khan <[email protected]>
> Reviewed-by: Kees Cook <[email protected]>
> Signed-off-by: Mickaël Salaün <[email protected]>
> Link: https://lore.kernel.org/r/[email protected]
> ---
Thanks: I've never been unlucky enough to hit this, but it's definitely a bug.
We should ideally mark it with a fixes tag:
Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero")
Reviewed-by: David Gow <[email protected]>
Cheers,
-- David
>
> Changes since v1:
> * Added Kees's Reviewed-by.
> ---
> lib/kunit/try-catch.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
> index a5cb2ef70a25..73f5007f20ea 100644
> --- a/lib/kunit/try-catch.c
> +++ b/lib/kunit/try-catch.c
> @@ -11,6 +11,7 @@
> #include <linux/completion.h>
> #include <linux/kernel.h>
> #include <linux/kthread.h>
> +#include <linux/sched/task.h>
>
> #include "try-catch-impl.h"
>
> @@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
> try_catch->context = context;
> try_catch->try_completion = &try_completion;
> try_catch->try_result = 0;
> - task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
> - try_catch,
> - "kunit_try_catch_thread");
> + task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
> + try_catch, "kunit_try_catch_thread");
> if (IS_ERR(task_struct)) {
> try_catch->try_result = PTR_ERR(task_struct);
> try_catch->catch(try_catch->context);
> return;
> }
> + get_task_struct(task_struct);
> + wake_up_process(task_struct);
>
> time_remaining = wait_for_completion_timeout(&try_completion,
> kunit_test_timeout());
> @@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
> kthread_stop(task_struct);
> }
>
> + put_task_struct(task_struct);
> exit_code = try_catch->try_result;
>
> if (!exit_code)
> --
> 2.44.0
>