From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C59A5C7EE29 for ; Thu, 25 May 2023 22:45:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 26989900003; Thu, 25 May 2023 18:45:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 21908900002; Thu, 25 May 2023 18:45:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0BAAA900003; Thu, 25 May 2023 18:45:04 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id EBFBA900002 for ; Thu, 25 May 2023 18:45:03 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id A05B5AE97D for ; Thu, 25 May 2023 22:45:03 +0000 (UTC) X-FDA: 80830259286.16.DDAFCEE Received: from mail-yw1-f180.google.com (mail-yw1-f180.google.com [209.85.128.180]) by imf04.hostedemail.com (Postfix) with ESMTP id 778A140004 for ; Thu, 25 May 2023 22:45:01 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=TjYjn6Km; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf04.hostedemail.com: domain of hughd@google.com designates 209.85.128.180 as permitted sender) smtp.mailfrom=hughd@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1685054701; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Zr4PzYVvcFu5HRS+oUxUsdXhS9HU/i14IGA9kInV6TU=; b=GrK4cjG1HZPhiGRovySS1wFzNzrLlV4uSueNJ+YHrptPXCj42PBwwmlsQ9F50eOnCZzUEQ I6cArN3PNTBLG3l6+El1P3JJAWgV3bKnLCXEVypwzPawAscP2i0YR+qIw6cddOQAF/Yvgl 0MyCe4cA2wjZb/9AhS0kBwyz02Aq6Vo= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=TjYjn6Km; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf04.hostedemail.com: domain of hughd@google.com designates 209.85.128.180 as permitted sender) smtp.mailfrom=hughd@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1685054701; a=rsa-sha256; cv=none; b=vPg82cpXjq61Qp3ue+09O+J6aJwA+ikFYZ0/mRSqBgbUL1ZPW0z7DIAPaXwhtyZ4JL4ylf aITwm9XiyTt5cM4DgJMFnxUsGoVzbCXBt55n2Dxt14gHY/+8b6br5DUB2CtNRawSkEpPPh 4OljEAiItMt5qwnLd8PmOcrnnHsTj/U= Received: by mail-yw1-f180.google.com with SMTP id 00721157ae682-565014fc2faso3871757b3.1 for ; Thu, 25 May 2023 15:45:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1685054701; x=1687646701; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:from:to:cc:subject:date:message-id:reply-to; bh=Zr4PzYVvcFu5HRS+oUxUsdXhS9HU/i14IGA9kInV6TU=; b=TjYjn6KmCyyJoAwue8HvkMTmfxRDWJmcG7ZWa2chlQXhANNAMx3kHaK351lIiAi+uY vFFSUg8DiT7CdeXRGnrHCVXgLTnx8tkMOzpr5+TilY0wRHNjGkNLnmvsjyuUDrTqtUI/ RG5grrCzluZapGlbCT3mM6N1154bwAnoJEy4RLT/99t2w/zb4rVnhnC7nIu+boxKICfs vryo9pRudQRKchESj5rFv0xLwTV76PzVVLzTMKB6PRmMuwV4K/qZql1Yu7rfEYJQNQUK Kk3m2ZGaHDh4pIO45OUhc2gN2+wRG4l6W3dASY6XMmMoxC1GGvHnrruNoYZFbTuwVYHZ ea9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685054701; x=1687646701; h=mime-version:references:message-id:in-reply-to:subject:cc:to:from :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=Zr4PzYVvcFu5HRS+oUxUsdXhS9HU/i14IGA9kInV6TU=; b=MT/bpaiXQrWlUxFD06nVBqfT3LOU+MWJ7xggW1sZJdjtNxOE3iT3QGHyuO9CEKyEdY 2MSm57UhFl7MlDkDyL1kitZAXO599mHJ9EJ7wrvoD1mpfdkIjzLIRZvxRWqdlle84wJF mtJj50XHnrU1LSxOxonHO5GYbuJqTFe+2Pfktl82QA23p5gDAy09V+2F6MRz4YyWKgEW Sl7Yp0fExm0M7VS3nr/xA4TfvCH1d47gQMOwzkRbbPMcWZ3myjtAjDan0XRwcJ8uNixv rpHvXOHqlJcWlUAy332R6+c2gn1vkEq9qCEqibIxp+hHLn2MHpxTXvEmJ+bV/M+xAMbT zh5Q== X-Gm-Message-State: AC+VfDwxs7aiKNitOPtjA/Q4+Wl6Dp0GUIUVC5laP8qIwsStbY4+UJVh bOjrq4WL0XpVc/Hn4uTBFluAYg== X-Google-Smtp-Source: ACHHUZ7PWCnU65QmVAHZO/udLtMlEKOZXpL3ccFnkwF15Ous02mDtojdRLGZ24kcfmtChFQBDV0BqQ== X-Received: by 2002:a0d:d4d5:0:b0:565:8c16:a0e1 with SMTP id w204-20020a0dd4d5000000b005658c16a0e1mr53112ywd.13.1685054700797; Thu, 25 May 2023 15:45:00 -0700 (PDT) Received: from ripple.attlocal.net (172-10-233-147.lightspeed.sntcca.sbcglobal.net. [172.10.233.147]) by smtp.gmail.com with ESMTPSA id i22-20020a0ddf16000000b00556aa81f615sm716151ywe.68.2023.05.25.15.44.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 May 2023 15:45:00 -0700 (PDT) Date: Thu, 25 May 2023 15:44:52 -0700 (PDT) From: Hugh Dickins X-X-Sender: hugh@ripple.attlocal.net To: Tu Jinjiang cc: hughd@google.com, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, wangkefeng.wang@huawei.com, sunnanyong@huawei.com Subject: Re: [PATCH] mm: shmem: Fix UAF bug in shmem_show_options() In-Reply-To: <20230525031640.593733-1-tujinjiang@huawei.com> Message-ID: <489cb23-7860-feb8-1b58-3586db1be3@google.com> References: <20230525031640.593733-1-tujinjiang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII X-Rspamd-Queue-Id: 778A140004 X-Rspam-User: X-Rspamd-Server: rspam05 X-Stat-Signature: n35rodpr7khhbis7fgw8qeq9sf4ojsgq X-HE-Tag: 1685054701-649490 X-HE-Meta: U2FsdGVkX18JozUc2L5sAWeAgIxdKji6J3N7HMoKtNTEAjaQOH0wiTcy7NazHie1QdM2Z+A67tyIAft7Kp0TYlilj+i6re0uaIJqVxHPR6DwRytEHoy7D+Qi0XXnCRbrbemjyeZg83Gw7eS2ThBZBe0SY/VT/RltYQrsDLdlpLMIKsUdOFQ4YC/vOq0BtF1U191sz2AxMGrgUkgOhjxBsiTHel/cYikdKxg8H+IzUPNQF7oUtCWgqKlFWtV3hEXjj8K080FtqlUwRVHzUBlox0EpSq7uHLcG0KO1t6/3WexcXQ11elTOKD58DLYHxQH4sTcnpQnXvdBHHg7XxPGJi8P3rAHKnDKZgw2Rv6TVM+QG/W7YwQ1ATJhoRlOQht8p6Kcz8T71dsFfriuPFOB2+EDPRDPLWNvyoGf7wOa1iz/18b84sDSXRna5giZainOap8t64vLxlVYEK7IgdYCiXqofJetp9NkVYL24k56HlBzhFEFJx60sHVBaw5xoLUAAIHk3fqlW71EPK3hfvf4airlSW+lGsGshxIprg1APTNjL7rt3JpUTXxhIWLJTGkVXa+OO+VdgsBEBlhsNowPUazWWImWCvr9l49llBIv8h4EmRugehJFbTwov2fAIqqW9ageCP/anynnPMt9Ii9lXXFKOcmRAjN0txzNmopj26FysuXlUCkNhghq7GGIt7UIEjsPPhS0XN1R/yBE7hm0ggpxRVHCP6kQVLW1WHD3x4hEmqWK54/Q2YuvNrEcLWULJsDw3CHefqLZAT8ws/7ZtvcfwYOkzny0ndfwJdejiLUYNFkRzW1XYZLB/k7rfkduQZZTiUL4R2bqDekuZyXgZvDanTEpTDLwg/+T6aNgJNyozHFs3ucjbJm3k+XkrmAaydSvRJGY+25plkP+fnGwPH3IT99tSdXWSxAp3wndNutnk03sBWatmDcIHjmYKTsT7WwHdJnNqdurG3bXN6rB HN6kZzPY fBL9pbqgueG/YeYtY5oRyh/Srz8NGDCyJBcurll+5r8nmEE2Q/4lrV7lPzmPYMjB+Xj3BtrF4NWPk7agX696I6FlegGrfIDPCEaLm9HK0d23hKZMCiZXaFoDlqGUDJ9KJAgD4N2Cl7/oG8zv3dymhuxX6vfY26LdMmMNflz90IE9PirwronqyjwVA5q0UXmbTyUvYTwqjU5vorfn08NPU6rnHmTZxS6er1F3jAfkCOr8vm3kS+sJ4wPsPY/8LLoZUCiRyVAgBMr72x0np1Wz+txVX2XfcwQ5TLeCJthhsz/zIcSUFDBwHzR33y3LI+XmbGlFco+3K3p9atp4SAOEDhO+hEHobjGO7+TDatfC7THoF6KU6EA8/jnbmA54o2KjdnQbEKx1chWkupwhoppseuiezCzKU01P02Jq++3RH69+eye26JVoMmyrpCzQyzVjvL6qz4APx8Wrrm20= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, 25 May 2023, Tu Jinjiang wrote: > shmem_show_options() uses sbinfo->mpol without adding it's refcnt. This > may lead to race with replacement of the mpol by remount. The execution > sequence is as follows. > > CPU0 CPU1 > shmem_show_options() shmem_reconfigure() > shmem_show_mpol(seq, sbinfo->mpol) mpol = sbinfo->mpol > mpol_put(mpol) > mpol->mode > > The KASAN report is as follows. > > BUG: KASAN: slab-use-after-free in shmem_show_options+0x21b/0x340 > Read of size 2 at addr ffff888124324004 by task mount/2388 > > CPU: 2 PID: 2388 Comm: mount Not tainted 6.4.0-rc3-00017-g9d646009f65d-dirty #8 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 > Call Trace: > > dump_stack_lvl+0x37/0x50 > print_report+0xd0/0x620 > ? shmem_show_options+0x21b/0x340 > ? __virt_addr_valid+0xf4/0x180 > ? shmem_show_options+0x21b/0x340 > kasan_report+0xb8/0xe0 > ? shmem_show_options+0x21b/0x340 > shmem_show_options+0x21b/0x340 > ? __pfx_shmem_show_options+0x10/0x10 > ? strchr+0x2c/0x50 > ? strlen+0x23/0x40 > ? seq_puts+0x7d/0x90 > show_vfsmnt+0x1e6/0x260 > ? __pfx_show_vfsmnt+0x10/0x10 > ? __kasan_kmalloc+0x7f/0x90 > seq_read_iter+0x57a/0x740 > vfs_read+0x2e2/0x4a0 > ? __pfx_vfs_read+0x10/0x10 > ? down_write_killable+0xb8/0x140 > ? __pfx_down_write_killable+0x10/0x10 > ? __fget_light+0xa9/0x1e0 > ? up_write+0x3f/0x80 > ksys_read+0xb8/0x150 > ? __pfx_ksys_read+0x10/0x10 > ? fpregs_assert_state_consistent+0x55/0x60 > ? exit_to_user_mode_prepare+0x2d/0x120 > do_syscall_64+0x3c/0x90 > entry_SYSCALL_64_after_hwframe+0x72/0xdc > > > > Allocated by task 2387: > kasan_save_stack+0x22/0x50 > kasan_set_track+0x25/0x30 > __kasan_slab_alloc+0x59/0x70 > kmem_cache_alloc+0xdd/0x220 > mpol_new+0x83/0x150 > mpol_parse_str+0x280/0x4a0 > shmem_parse_one+0x364/0x520 > vfs_parse_fs_param+0xf8/0x1a0 > vfs_parse_fs_string+0xc9/0x130 > shmem_parse_options+0xb2/0x110 > path_mount+0x597/0xdf0 > do_mount+0xcd/0xf0 > __x64_sys_mount+0xbd/0x100 > do_syscall_64+0x3c/0x90 > entry_SYSCALL_64_after_hwframe+0x72/0xdc > > Freed by task 2389: > kasan_save_stack+0x22/0x50 > kasan_set_track+0x25/0x30 > kasan_save_free_info+0x2e/0x50 > __kasan_slab_free+0x10e/0x1a0 > kmem_cache_free+0x9c/0x350 > shmem_reconfigure+0x278/0x370 > reconfigure_super+0x383/0x450 > path_mount+0xcc5/0xdf0 > do_mount+0xcd/0xf0 > __x64_sys_mount+0xbd/0x100 > do_syscall_64+0x3c/0x90 > entry_SYSCALL_64_after_hwframe+0x72/0xdc > > The buggy address belongs to the object at ffff888124324000 > which belongs to the cache numa_policy of size 32 > The buggy address is located 4 bytes inside of > freed 32-byte region [ffff888124324000, ffff888124324020) > ================================================================== > > To fix the bug, shmem_get_sbmpol() / mpol_put() needs to be called > before / after shmem_show_mpol() call. > > Signed-off-by: Tu Jinjiang Thank you - Acked-by: Hugh Dickins > --- > mm/shmem.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/mm/shmem.c b/mm/shmem.c > index e40a08c5c6d7..5e54ab5f61f2 100644 > --- a/mm/shmem.c > +++ b/mm/shmem.c > @@ -3726,6 +3726,7 @@ static int shmem_reconfigure(struct fs_context *fc) > static int shmem_show_options(struct seq_file *seq, struct dentry *root) > { > struct shmem_sb_info *sbinfo = SHMEM_SB(root->d_sb); > + struct mempolicy *mpol; > > if (sbinfo->max_blocks != shmem_default_max_blocks()) > seq_printf(seq, ",size=%luk", > @@ -3768,7 +3769,9 @@ static int shmem_show_options(struct seq_file *seq, struct dentry *root) > if (sbinfo->huge) > seq_printf(seq, ",huge=%s", shmem_format_huge(sbinfo->huge)); > #endif > - shmem_show_mpol(seq, sbinfo->mpol); > + mpol = shmem_get_sbmpol(sbinfo); > + shmem_show_mpol(seq, mpol); > + mpol_put(mpol); > if (sbinfo->noswap) > seq_printf(seq, ",noswap"); > return 0; > -- > 2.25.1