Re: Re: CVE request: pid namespace leak in kernel 3.0 and 3.1

[Marcus Meissner <meissner () suse de>]

On Fri, Apr 20, 2012 at 12:14:14AM -0700, Eric W. Biederman wrote:
> Eugene Teo <eugeneteo () kernel sg> writes:
>
> > > So we know what is holding the pid namespace reference.
> > >
> > > Additional thoughts.
> > >
> > > Does echo 3 > /proc/sys/vm/drop_caches clear up the issue?
> >
> > No.
> >
> > > Is there a corresponding task_struct leak?
> >
> > Yes.
>
> Hmm.  The zombies are reaped? 
>
> I am scratching my head perhaps because I am looking at the current code
> but I don't seem to see how a task that pins a pid can get past
> release_task (the zombie reaper) and in particular past in release
> __exit_signal() which calls unhash_process().
>
> The simple test to see if we have made it past unhash_process is to see
> if you can see the zombie processes.
>
> > I'm helping to provide more information.
>
> You are.  Thank you for looking to see what the symptoms are.

Jeff Mahoney did locate the introducer and the fix yesterday night ...



Introduced in 423e0ab086ad8b33626e45fa94ac7613146b7ffa (in Linux 3.1 timeframe)

Date:   Tue Jul 19 09:32:38 2011 -0700

    VFS : mount lock scalability for internal mounts

And the fixed in Linux 3.2:

commit 905ad269c55fc62bee3da29f7b1d1efeba8aa1e1
Author: Al Viro <viro () zeniv linux org uk>
Date:   Thu Dec 8 23:20:45 2011 -0500

    procfs: fix a vfsmount longterm reference leak

    kern_mount() doesn't pair with plain mntput()...


We (SUSE) did backport the buggy patch to our SLE11 SP2 Linux 3.0 kernel, which made
it also show up there.

So mainline kernels affected: "Linux Kernel 3.1"

Ciao, Marcus