Unverified Commit 03adc61e authored by Dan Clash's avatar Dan Clash Committed by Christian Brauner
Browse files

audit,io_uring: io_uring openat triggers audit reference count underflow 

An io_uring openat operation can update an audit reference count
from multiple threads resulting in the call trace below.

A call to io_uring_submit() with a single openat op with a flag of
IOSQE_ASYNC results in the following reference count updates.

These first part of the system call performs two increments that do not race.

do_syscall_64()
  __do_sys_io_uring_enter()
    io_submit_sqes()
      io_openat_prep()
        __io_openat_prep()
          getname()
            getname_flags()       /* update 1 (increment) */
              __audit_getname()   /* update 2 (increment) */

The openat op is queued to an io_uring worker thread which starts the
opportunity for a race.  The system call exit performs one decrement.

do_syscall_64()
  syscall_exit_to_user_mode()
    syscall_exit_to_user_mode_prepare()
      __audit_syscall_exit()
        audit_reset_context()
           putname()              /* update 3 (decrement) */

The io_uring worker thread performs one increment and two decrements.
These updates can race with the system call decrement.

io_wqe_worker()
  io_worker_handle_work()
    io_wq_submit_work()
      io_issue_sqe()
        io_openat()
          io_openat2()
            do_filp_open()
              path_openat()
                __audit_inode()   /* update 4 (increment) */
            putname()             /* update 5 (decrement) */
        __audit_uring_exit()
          audit_reset_context()
            putname()             /* update 6 (decrement) */

The fix is to change the refcnt member of struct audit_names
from int to atomic_t.

kernel BUG at fs/namei.c:262!
Call Trace:
...
 ? putname+0x68/0x70
 audit_reset_context.part.0.constprop.0+0xe1/0x300
 __audit_uring_exit+0xda/0x1c0
 io_issue_sqe+0x1f3/0x450
 ? lock_timer_base+0x3b/0xd0
 io_wq_submit_work+0x8d/0x2b0
 ? __try_to_del_timer_sync+0x67/0xa0
 io_worker_handle_work+0x17c/0x2b0
 io_wqe_worker+0x10a/0x350

Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/lkml/MW2PR2101MB1033FFF044A258F84AEAA584F1C9A@MW2PR2101MB1033.namprd21.prod.outlook.com/


Fixes: 5bd2182d ("audit,io_uring,io-wq: add some basic audit support to io_uring")
Signed-off-by: default avatarDan Clash <daclash@linux.microsoft.com>
Link: https://lore.kernel.org/r/20231012215518.GA4048@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net


Reviewed-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 94f6f055

fs/namei.c

+5 −4
Original line number Original line Diff line number Diff line
@@ -188,7 +188,7 @@ getname_flags(const char __user *filename, int flags, int *empty) 
		}

		}

	}

	}





	result->refcnt = 1;

	atomic_set(&result->refcnt, 1);

	/* The empty path is special. */

	/* The empty path is special. */

	if (unlikely(!len)) {

	if (unlikely(!len)) {

		if (empty)

		if (empty)
@@ -249,7 +249,7 @@ getname_kernel(const char * filename) 
	memcpy((char *)result->name, filename, len);

	memcpy((char *)result->name, filename, len);

	result->uptr = NULL;

	result->uptr = NULL;

	result->aname = NULL;

	result->aname = NULL;

	result->refcnt = 1;

	atomic_set(&result->refcnt, 1);

	audit_getname(result);

	audit_getname(result);





	return result;

	return result;
@@ -261,9 +261,10 @@ void putname(struct filename *name) 
	if (IS_ERR(name))

	if (IS_ERR(name))

		return;

		return;





	BUG_ON(name->refcnt <= 0);

	if (WARN_ON_ONCE(!atomic_read(&name->refcnt)))

		return;





	if (--name->refcnt > 0)

	if (!atomic_dec_and_test(&name->refcnt))

		return;

		return;





	if (name->name != name->iname) {

	if (name->name != name->iname) {

include/linux/fs.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -2403,7 +2403,7 @@ struct audit_names; 
struct filename {

struct filename {

	const char		*name;	/* pointer to actual string */

	const char		*name;	/* pointer to actual string */

	const __user char	*uptr;	/* original userland pointer */

	const __user char	*uptr;	/* original userland pointer */

	int			refcnt;

	atomic_t		refcnt;

	struct audit_names	*aname;

	struct audit_names	*aname;

	const char		iname[];

	const char		iname[];

};

};

kernel/auditsc.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -2212,7 +2212,7 @@ __audit_reusename(const __user char *uptr) 
		if (!n->name)

		if (!n->name)

			continue;

			continue;

		if (n->name->uptr == uptr) {

		if (n->name->uptr == uptr) {

			n->name->refcnt++;

			atomic_inc(&n->name->refcnt);

			return n->name;

			return n->name;

		}

		}

	}

	}
@@ -2241,7 +2241,7 @@ void __audit_getname(struct filename *name) 
	n->name = name;

	n->name = name;

	n->name_len = AUDIT_NAME_FULL;

	n->name_len = AUDIT_NAME_FULL;

	name->aname = n;

	name->aname = n;

	name->refcnt++;

	atomic_inc(&name->refcnt);

}

}





static inline int audit_copy_fcaps(struct audit_names *name,

static inline int audit_copy_fcaps(struct audit_names *name,
@@ -2373,7 +2373,7 @@ void __audit_inode(struct filename *name, const struct dentry *dentry, 
		return;

		return;

	if (name) {

	if (name) {

		n->name = name;

		n->name = name;

		name->refcnt++;

		atomic_inc(&name->refcnt);

	}

	}





out:

out:
@@ -2500,7 +2500,7 @@ void __audit_inode_child(struct inode *parent, 
		if (found_parent) {

		if (found_parent) {

			found_child->name = found_parent->name;

			found_child->name = found_parent->name;

			found_child->name_len = AUDIT_NAME_FULL;

			found_child->name_len = AUDIT_NAME_FULL;

			found_child->name->refcnt++;

			atomic_inc(&found_child->name->refcnt);

		}

		}

	}

	}