From nobody Mon Jan 06 22:56:58 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YRqLf2fC9z5kMQ1; Mon, 06 Jan 2025 22:56:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YRqLf2CSHz4rf6; Mon, 6 Jan 2025 22:56:58 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736204218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ieWiXLK3m/iUfsltk6RXefsASuAfTda0fuliACSwzuQ=; b=YBo4XqJrHBs+TD8cGAAq6/dR0eEvHaWuyvWpGXh3ept0KSvbZl15GIUIoNmCQvILVdXV3Q 1E9/ZK032FIdQ+e+JD+9b4AXxGAA3Z+kU9du1D7PC+IZMTSnIZQiVy+jl+YIE9uJu6HQPg 1D84HiIYdATeCoZfJmm00kQFQPAN7H30UUl2lwilURWyWfUuX/THhDYPxite5yIf31ExwE 2S0S/VDiO8EhsoDXvQP60CKXCmoowG7AfFez3QMcl/d8pEhCv+Pgj0bIlfJqj26/0qwVqN NC38caOSXe+ZmyrLFPtQa0pFzYu0trD1a1jyV9dmTJb72JN0Iw+p+6tbZl07xA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1736204218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ieWiXLK3m/iUfsltk6RXefsASuAfTda0fuliACSwzuQ=; b=irGX9MBX+iEjBLBrjS3WUq+ALdVbznIm064Dqv1lnAOLj5CEs4ij8lpQTLWHUMJOIRVeXn wC+5PBkXKkCc/p9kq34vccEh5x1iKULl8u81b1XxEFx4UmN05eDvKWWSZvYOWZYedbUOdS K8YH2L/r+2nMfcB/uB6HgEgb9xGNZjPI65dGvrBOgfHwOwyvQFmEbFts71qpKWy/6lrPtE 5LnhDXJW0NctPy3mR/qD0hrYh1ZCRR/oH1K+drZVRuuZmSBwsBEnYI2odSnaSlaU8KfNkT s/IvyrRdjxKAX0c6XNihQMBwRIuoawmQhXnTNHL1JXabBJvEeXBBzllJfpioxg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1736204218; a=rsa-sha256; cv=none; b=hi347C+ypEztRfHjNI9jZeqPMtaruSagPmhM+Bu05FVDVES1eeeV67WonWn/F5+tDP3sIO uZ2hnYuycX1jsUEhizZ6pqDANWaTvWLIf8I6HTcq1k0uPlFxN9dQsLxX/RAtzP8BqBdAfY rnRER5mVmWblH1njw/kcOPfq+jrWkEVtuMpTeKObqa8cuTDrr5jqdEu+bSbdTjgslsMvXx aD1eDJFVnnLPNOtjeiDCad2e70alk8YD1eRBlMZfwyCinIKpcUr7zVJR/oGYRr+Ubz4fhE ZCUxCV0/eF38pATJZj8ikmhnh/XvowFRBxx15HhSa26pufB1h3ZMVLp1Xzhniw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YRqLf1p2Qzkdt; Mon, 06 Jan 2025 22:56:58 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 506MuwW5050052; Mon, 6 Jan 2025 22:56:58 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 506MuwxS050049; Mon, 6 Jan 2025 22:56:58 GMT (envelope-from git) Date: Mon, 6 Jan 2025 22:56:58 GMT Message-Id: <202501062256.506MuwxS050049@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Mark Johnston Subject: git: 8c75c15d43e4 - main - jail: Avoid a potential use-after-free when destroying jails List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8c75c15d43e4123bc51f24f5bf99319289c45a6c Auto-Submitted: auto-generated The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8c75c15d43e4123bc51f24f5bf99319289c45a6c commit 8c75c15d43e4123bc51f24f5bf99319289c45a6c Author: Mark Johnston AuthorDate: 2025-01-06 22:53:38 +0000 Commit: Mark Johnston CommitDate: 2025-01-06 22:53:38 +0000 jail: Avoid a potential use-after-free when destroying jails prison_deref() and prison_deref_kill() have to handle the case where destruction of a jail will release the final reference on the jail's parent, resulting in destruction of the parent jail. They thus maintain a list of jails whose references have gone away; the loop at the end of prison_deref() then goes through the list and deallocates resources associated with each jail. In particular, if a jail's VNET is not the same as that of its parent, this loop destroys the VNET. Suppose prison_deref() removes the last reference on a jail, releasing a reference to its parent and causing the jail to be placed in the "freeprison" list. Suppose then that the parent jail is destroyed before the "freeprison" list is processed. When destroying the now-orphaned child jail, prison_deref() derefences its parent to see whether the child jail's VNET needs to be freed, but if this race occurs, this is a use-after-free. Fix the problem by using PR_VNET to decide whether the jail's VNET is to be destroyed, rather than dereferencing the parent jail pointer. Set it earlier so that a subsequent failure in kern_jail_set() cleans up the nascent VNET. Reviewed by: zlei (previous version), jamie MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D47992 --- sys/kern/kern_jail.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c index ad6483ed374d..6ffeab59112b 100644 --- a/sys/kern/kern_jail.c +++ b/sys/kern/kern_jail.c @@ -1687,9 +1687,18 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags) sizeof(pr->pr_osrelease)); #ifdef VIMAGE - /* Allocate a new vnet if specified. */ - pr->pr_vnet = (pr_flags & PR_VNET) - ? vnet_alloc() : ppr->pr_vnet; + /* + * Allocate a new vnet if specified. + * + * Set PR_VNET now if so, so that the vnet is disposed of + * properly when the jail is destroyed. + */ + if (pr_flags & PR_VNET) { + pr->pr_flags |= PR_VNET; + pr->pr_vnet = vnet_alloc(); + } else { + pr->pr_vnet = ppr->pr_vnet; + } #endif /* * Allocate a dedicated cpuset for each jail. @@ -3207,9 +3216,12 @@ prison_deref(struct prison *pr, int flags) * Removing a prison frees references * from its parent. */ + ppr = pr->pr_parent; + pr->pr_parent = NULL; mtx_unlock(&pr->pr_mtx); + + pr = ppr; flags &= ~PD_LOCKED; - pr = pr->pr_parent; flags |= PD_DEREF | PD_DEUREF; continue; } @@ -3236,7 +3248,7 @@ prison_deref(struct prison *pr, int flags) */ TAILQ_FOREACH_SAFE(rpr, &freeprison, pr_list, tpr) { #ifdef VIMAGE - if (rpr->pr_vnet != rpr->pr_parent->pr_vnet) + if (rpr->pr_flags & PR_VNET) vnet_destroy(rpr->pr_vnet); #endif if (rpr->pr_root != NULL)