From: Andrew Morton <akpm@linux-foundation.org>
To: vitaly.wool@konsulko.com
Cc: linux-mm@kvack.org, stable@kernel.org, cai@lca.pw,
shentino@gmail.com, Uladzislau Rezki <uladzislau.rezki@sony.com>
Subject: Re: [PATCH] z3fold: fix use-after-free when freeing handles
Date: Wed, 20 May 2020 17:46:08 -0700 [thread overview]
Message-ID: <20200520174608.a9a9b60e30d3d372ced5b0e3@linux-foundation.org> (raw)
In-Reply-To: <20200520082100.28876-1-vitaly.wool@konsulko.com>
On Wed, 20 May 2020 11:21:00 +0300 vitaly.wool@konsulko.com wrote:
> From: Uladzislau Rezki <uladzislau.rezki@sony.com>
>
> free_handle() for a foreign handle may race with inter-page
> compaction, what can lead to memory corruption. To avoid that,
> take write lock not read lock in free_handle to be synchronized
> with __release_z3fold_page().
>
> For example KASAN can detect it:
>
> [ 33.723357] ==================================================================
> [ 33.723401] BUG: KASAN: use-after-free in LZ4_decompress_safe+0x2c4/0x3b8
> [ 33.723418] Read of size 1 at addr ffffffc976695ca3 by task GoogleApiHandle/4121
> [ 33.723428]
> [ 33.723449] CPU: 0 PID: 4121 Comm: GoogleApiHandle Tainted: P S OE 4.19.81-perf+ #162
> [ 33.723461] Hardware name: Sony Mobile Communications. PDX-203(KONA) (DT)
> [ 33.723473] Call trace:
> [ 33.723495] dump_backtrace+0x0/0x288
> [ 33.723512] show_stack+0x14/0x20
> [ 33.723533] dump_stack+0xe4/0x124
> [ 33.723551] print_address_description+0x80/0x2e0
> [ 33.723566] kasan_report+0x268/0x2d0
> [ 33.723584] __asan_load1+0x4c/0x58
> [ 33.723601] LZ4_decompress_safe+0x2c4/0x3b8
> [ 33.723619] lz4_decompress_crypto+0x3c/0x70
> [ 33.723636] crypto_decompress+0x58/0x70
> [ 33.723656] zcomp_decompress+0xd4/0x120
> ...
>
> Apart from that, initialize zhdr->mapped_count in init_z3fold_page()
> and remove "newpage" variable because it is not used anywhere.
>
> Signed-off-by: Uladzislau Rezki <uladzislau.rezki@sony.com>
> Signed-off-by: Vitaly Wool <vitaly.wool@konsulko.com>
I assume that a cc:stable is appropriate here?
next prev parent reply other threads:[~2020-05-21 0:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 8:21 vitaly.wool
2020-05-21 0:46 ` Andrew Morton [this message]
2020-05-21 8:04 ` Vitaly Wool
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200520174608.a9a9b60e30d3d372ced5b0e3@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=cai@lca.pw \
--cc=linux-mm@kvack.org \
--cc=shentino@gmail.com \
--cc=stable@kernel.org \
--cc=uladzislau.rezki@sony.com \
--cc=vitaly.wool@konsulko.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox