posix-cpu-timers: fix nanosleep task_struct leak
PATCH v2 1/1 posix-cpu-timers: fix nanosleep task_struct leak
In do_cpu_nanosleep() we do posic_cpu_timer_create(), but forgot corresponding posix_cpu_timer_del() what lead to task_struct leak.
Reported-and-tested-by Tommi Rantala <[email protected]>
Signed-off-by Stanislaw Gruszka <[email protected]>
---
v1 -> v2: add comments
This looks like DoS problem fix, since it's possible to eat kernel memory (very slowly though) by normal user, hence Cc stable.
kernel/posix-cpu-timers.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
kernel/posix-cpu-timers.c +21 -2
@@ -1401,8 +1401,10 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,while (!signal_pending (current)) {if (timer.it.cpu.expires.sched ==0 ) {/* -* Our timer fired and was reset. +* Our timer fired and was reset, below +* deletion can not fail. */ +posix_cpu_timer_del (&timer);spin_unlock_irq (&timer.it_lock);return 0 ; }
@@ -1420,9 +1422,26 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,* We were interrupted by a signal. */ sample_to_timespec (which_clock, timer.it.cpu.expires, rqtp); -posix_cpu_timer_set (&timer,0 , &zero_it, it); + error =posix_cpu_timer_set (&timer,0 , &zero_it, it); +if (!error) { +/* +* Timer is now unarmed, deletion can not fail. +*/ +posix_cpu_timer_del (&timer); + }spin_unlock_irq (&timer.it_lock); +while (error ==TIMER_RETRY ) { +/* +* We need to handle case when timer was or is in the +* middle of firing. In other cases we already freed +* resources. +*/ +spin_lock_irq (&timer.it_lock); + error =posix_cpu_timer_del (&timer); +spin_unlock_irq (&timer.it_lock); + } +if ((it->it_value.tv_sec | it->it_value.tv_nsec) ==0 ) {/* * It actually did fire already.
Signature · 1 line
1.7.11.7
[tip:timers/core] posix-cpu-timers: Fix nanosleep task_struct leak
Commit-ID: e6c42c295e071dd74a66b5a9fcf4f44049888ed8 Gitweb: http://git.kernel.org/tip/e6c42c295e071dd74a66b5a9fcf4f44049888ed8 Author: Stanislaw Gruszka <[email protected]> AuthorDate: Fri, 15 Feb 2013 11:08:11 +0100 Committer: Thomas Gleixner <[email protected]> CommitDate: Fri, 15 Feb 2013 11:41:56 +0100
posix-cpu-timers: Fix nanosleep task_struct leak
The trinity fuzzer triggered a task_struct reference leak via clock_nanosleep with CPU_TIMERs. do_cpu_nanosleep() calls posic_cpu_timer_create(), but misses a corresponding posix_cpu_timer_del() which leads to the task_struct reference leak.
Reported-and-tested-by Tommi Rantala <[email protected]>
Signed-off-by Stanislaw Gruszka <[email protected]>
Cc Dave Jones <[email protected]>
Cc John Stultz <[email protected]>
Cc Oleg Nesterov <[email protected]>
Signed-off-by Thomas Gleixner <[email protected]>
--- kernel/posix-cpu-timers.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
kernel/posix-cpu-timers.c +21 -2
@@ -1401,8 +1401,10 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,while (!signal_pending (current)) {if (timer.it.cpu.expires.sched ==0 ) {/* -* Our timer fired and was reset. +* Our timer fired and was reset, below +* deletion can not fail. */ +posix_cpu_timer_del (&timer);spin_unlock_irq (&timer.it_lock);return 0 ; }
@@ -1420,9 +1422,26 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags,* We were interrupted by a signal. */ sample_to_timespec (which_clock, timer.it.cpu.expires, rqtp); -posix_cpu_timer_set (&timer,0 , &zero_it, it); + error =posix_cpu_timer_set (&timer,0 , &zero_it, it); +if (!error) { +/* +* Timer is now unarmed, deletion can not fail. +*/ +posix_cpu_timer_del (&timer); + }spin_unlock_irq (&timer.it_lock); +while (error ==TIMER_RETRY ) { +/* +* We need to handle case when timer was or is in the +* middle of firing. In other cases we already freed +* resources. +*/ +spin_lock_irq (&timer.it_lock); + error =posix_cpu_timer_del (&timer); +spin_unlock_irq (&timer.it_lock); + } +if ((it->it_value.tv_sec | it->it_value.tv_nsec) ==0 ) {/* * It actually did fire already.