From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 005A0ECAAD8 for ; Wed, 21 Sep 2022 19:07:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id CB88A6B0071; Wed, 21 Sep 2022 15:07:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C68286B0072; Wed, 21 Sep 2022 15:07:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B7DFE940007; Wed, 21 Sep 2022 15:07:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id A9A496B0071 for ; Wed, 21 Sep 2022 15:07:54 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 7900F809BB for ; Wed, 21 Sep 2022 19:07:54 +0000 (UTC) X-FDA: 79937027268.09.C44C795 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by imf27.hostedemail.com (Postfix) with ESMTP id 0D26140015 for ; Wed, 21 Sep 2022 19:07:53 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 17A4CB8121A; Wed, 21 Sep 2022 19:07:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C35A7C433D6; Wed, 21 Sep 2022 19:07:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1663787270; bh=+dgwWgBjf4EjDuSy+NuN+4D3f+4fqKols2uXvgLzp6c=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=V9H7X499TAXk/psu574CoKuDuntHqiL08cIeLbaPTllmR3s8O2e9BD27lDC5dRDLp /Y4iAAewaV8hNRthPmI/09W+J7i5e4wKEwUObW8zaC4xZ6Btnf3u2Y2u858dUHqcUx XuSed0ogH8lPrMywzTT6KpAAhwTlxlXW/Zu1KvaQ= Date: Wed, 21 Sep 2022 12:07:48 -0700 From: Andrew Morton To: Liu Shixin Cc: Liu Zixian , Mike Kravetz , Muchun Song , , , Kefeng Wang Subject: Re: [PATCH] mm: hugetlb: fix UAF in hugetlb_handle_userfault Message-Id: <20220921120748.79f3255fa0a06b182576f497@linux-foundation.org> In-Reply-To: <20220921083440.1267903-1-liushixin2@huawei.com> References: <20220921083440.1267903-1-liushixin2@huawei.com> X-Mailer: Sylpheed 3.7.0 (GTK+ 2.24.33; x86_64-redhat-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1663787274; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=FJz/GmaV/T6w8MBoASwbnnxNDlayK4OQTIP3zNRDj3I=; b=Kbfeo6ub1ZXLDxECqwjlLkKA8mEQN1tOIQc/lvckg/GY5TjtqN1UmIU/3lL2E9Tk7uBkc3 IWkGIa7a/PrE3p9tvn9xB1vd+nHllVB1OzQSe/HcbUXaDddNk4F5DbBe4H060+qekBtA+e vFkEqiWw3ca4hSGGctghP3Kv4XA24Hg= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=V9H7X499; spf=pass (imf27.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1663787274; a=rsa-sha256; cv=none; b=Q3mIuSoMrPUiHViFTbUkPk6wIVz9Mwp2EYWUolLvq/kXXsFymE2ny1MBk/rFAkzQLrQRP9 iJmdTPnjZEdq3/L1+Das4JBPQaO90aIw91+kuExD7Vl2hpxr2wI9BLas13OY5LLAefKKGq MoYp+njd9+t6z+BvyX3vLgEXpOQMCAo= Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=V9H7X499; spf=pass (imf27.hostedemail.com: domain of akpm@linux-foundation.org designates 145.40.68.75 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org; dmarc=none X-Stat-Signature: ubd6ayfskhaj4qi168i6ae5eguknncdk X-Rspamd-Queue-Id: 0D26140015 X-Rspam-User: X-Rspamd-Server: rspam12 X-HE-Tag: 1663787273-729765 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, 21 Sep 2022 16:34:40 +0800 Liu Shixin wrote: > The vma_lock and hugetlb_fault_mutex are dropped before handling > userfault and reacquire them again after handle_userfault(), but > reacquire the vma_lock could lead to UAF[1] due to the following > race, > > hugetlb_fault > hugetlb_no_page > /*unlock vma_lock */ > hugetlb_handle_userfault > handle_userfault > /* unlock mm->mmap_lock*/ > vm_mmap_pgoff > do_mmap > mmap_region > munmap_vma_range > /* clean old vma */ > /* lock vma_lock again <--- UAF */ > /* unlock vma_lock */ > > Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), > let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix > the issue. > > @@ -5508,17 +5507,12 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma, > > /* > * vma_lock and hugetlb_fault_mutex must be > - * dropped before handling userfault. Reacquire > - * after handling fault to make calling code simpler. > + * dropped before handling userfault. > */ > hugetlb_vma_unlock_read(vma); > hash = hugetlb_fault_mutex_hash(mapping, idx); > mutex_unlock(&hugetlb_fault_mutex_table[hash]); > - ret = handle_userfault(&vmf, reason); > - mutex_lock(&hugetlb_fault_mutex_table[hash]); > - hugetlb_vma_lock_read(vma); > - > - return ret; > + return handle_userfault(&vmf, reason); > } Current code is rather different from this. So if the bug still exists in current code, please verify this and redo the patch appropriately? And hang on to this version to help with the -stable backporting. Thanks.