On Wed, May 09, 2012 at 05:25:14PM +0200, Sasha Levin wrote: > Hi all, > > I've started seeing the following warning while fuzzing inside a KVM guest with the latest -next: [->read() may grab ->cred_guard_mutex, but it may itself be called by prepare_binprm() after having ->cred_guard_mutex grabbed] Nasty, that... What's more, it's not just prepare_binprm() itself - ->load_binary() might end up calling read(); it doesn't have to limit itself to mmap(), so essentially anything that can be grabbed by ->read() of a regular file might nest under ->cred_guard_mutex. AFAICS, /proc/*/stack, /proc/*/syscall, /proc/*/personality, /proc/*/io_accounting, /proc/*/auxv, /proc/*/environ, /proc/*/*maps and /proc/*/pagemap have ->cred_guard_mutex grabbed on read. seq_file is a red herring here - io_accounting has the same issue and it does things directly, without seq_read(). It's not a realistic attack, fortunately, since you need root to get past open_exec() on any of those... Wait. How _did_ you get past open_exec(), anyway? MAY_EXEC is not supposed to be granted on anything that has no exec bits at all and AFAICS none of those files have them. -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
