From: ebiederm@xmission.com (Eric W. Biederman)
To: Dave Jones <davej@codemonkey.org.uk>
Cc: Alexey Dobriyan <adobriyan@gmail.com>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Linux Kernel <linux-kernel@vger.kernel.org>,
        syzkaller-bugs@googlegroups.com, Gargi Sharma <gs051095@gmail.com>,
        Oleg Nesterov <oleg@redhat.com>, Rik van Riel <riel@redhat.com>,
        Andrew Morton <akpm@linux-foundation.org>
References: <20171219033926.GA26981@codemonkey.org.uk>
        <87lghy7eul.fsf@xmission.com>
        <20171219193020.GA9237@codemonkey.org.uk>
        <878tdy5r5t.fsf@xmission.com> <87mv2e17vz.fsf@xmission.com>
        <20171220052803.GA17079@codemonkey.org.uk>
        <871sjp1cjz.fsf@xmission.com>
        <20171221031606.GA4636@codemonkey.org.uk>
        <87po78trjm.fsf@xmission.com>
        <CACVxJT_Sud7tNv23yOOqG7Uh5zFPDnz1anS7pTr0ChpCSMvZDA@mail.gmail.com>
        <20171221142535.GA17258@codemonkey.org.uk>
Date: Thu, 21 Dec 2017 10:41:22 -0600
In-Reply-To: <20171221142535.GA17258@codemonkey.org.uk> (Dave Jones's message
        of "Thu, 21 Dec 2017 09:25:35 -0500")
Message-ID: <87vah0rq31.fsf@xmission.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Subject: Re: proc_flush_task oops
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1679
Lines: 43

Dave Jones <davej@codemonkey.org.uk> writes:

> On Thu, Dec 21, 2017 at 12:38:12PM +0200, Alexey Dobriyan wrote:
>  > On 12/21/17, Eric W. Biederman <ebiederm@xmission.com> wrote:
>  > > I have stared at this code, and written some test programs and I can't
>  > > see what is going on.  alloc_pid by design and in implementation (as far
>  > > as I can see) is always single threaded when allocating the first pid
>  > > in a pid namespace.  idr_init always initialized idr_next to 0.
>  > >
>  > > So how we can get past:
>  > >
>  > > 	if (unlikely(is_child_reaper(pid))) {
>  > > 		if (pid_ns_prepare_proc(ns)) {
>  > > 			disable_pid_allocation(ns);
>  > > 			goto out_free;
>  > > 		}
>  > > 	}
>  > >
>  > > with proc_mnt still set to NULL is a mystery to me.
>  > >
>  > > Is there any chance the idr code doesn't always return the lowest valid
>  > > free number?  So init gets assigned something other than 1?
>  > 
>  > Well, this theory is easy to test (attached).
>
> I'll give this a shot and report back when I get to the office.
>
>  > There is a "valid" way to break the code via kernel.ns_last_pid:
>  > unshare+write+fork but the reproducer doesn't seem to use it (or it does?)
>
> that sysctl is root only, so that isn't at play here.

ns_capable(CAP_SYS_ADMIN) will allow root in a user namespace.   So the
sysctl should be fuzzable.

The ns_last_pid sysctl is still not in play because it changes
task_active_pid_ns (aka the pid namespace of the callers pid) not
pid_ns_for_children.  So it still is not in play.

Every time I think of a "valid" way to break the code, I double check
myself and find there are already checks in place to prevent that.

Eric