From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBA4AC7EE21 for ; Sun, 30 Apr 2023 13:35:07 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 60EB46B0072; Sun, 30 Apr 2023 09:35:07 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5BF756B0074; Sun, 30 Apr 2023 09:35:07 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 45F466B0075; Sun, 30 Apr 2023 09:35:07 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 3658C6B0072 for ; Sun, 30 Apr 2023 09:35:07 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id EDCDC1601A3 for ; Sun, 30 Apr 2023 13:35:06 +0000 (UTC) X-FDA: 80738153412.19.B02D47B Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by imf10.hostedemail.com (Postfix) with ESMTP id 058CEC001C for ; Sun, 30 Apr 2023 13:35:03 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=BmCyo1xo; spf=pass (imf10.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.52 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682861704; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=Q66B2VAsNUEUORNlqd/SH3lXkCF0Wmvm/NkUzg1deG4=; b=WRqGflXCY9qhLlOzGZ+lsPfRmL0o+XjoPzCEv+vhZC/25q6vq18f7jVLEgAwFKe9YKdbVR uqTKpl0cn5NqqrkpmKTUUB1PwaydVrPWA5RVymELnj1a7o4H/I4CSFPJm74ng6S4prL4H7 YFcjtaGE/Cu7zD9F4qnCwEolKMbqcHM= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=gmail.com header.s=20221208 header.b=BmCyo1xo; spf=pass (imf10.hostedemail.com: domain of lstoakes@gmail.com designates 209.85.128.52 as permitted sender) smtp.mailfrom=lstoakes@gmail.com; dmarc=pass (policy=none) header.from=gmail.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1682861704; a=rsa-sha256; cv=none; b=nwHRNm4BDPInQ/KjTK2NAxm4BW912++BmF5pby8DNiyX17sodIp+g3mg9WOcPI/DDyLofm fzrNhZGTnRTmiFqC2CW948xbBWwpWGnNGDB7AyIM8ndyiXaPR040vUmc6JnMw+N92vkWUz 69raDmy6qNxQxfB7Ydk7fcMpMAC5gCQ= Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-3f09b4a1527so17136275e9.0 for ; Sun, 30 Apr 2023 06:35:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682861702; x=1685453702; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=Q66B2VAsNUEUORNlqd/SH3lXkCF0Wmvm/NkUzg1deG4=; b=BmCyo1xoZ+cVDt6YzcEtIIxzt546M6p04my6rYSGd+KiYf6AriqYLQlNarK0WY0LxS pQoLafhW2AYJ3lPZTZEIwCVNrV6o0pGcJf5dPZ6XcpHsKIjxQZcOextuqkwLkiVm6jK4 00ydwThgdRiEh2NLwea1qsbBbvAKBsm8DN5tTj8tTfYrSOxj5TtqXBJiIExbwH5miNW8 MuXMpVS4GNFC2ik192kiP8SGLTOWS3ZMKqPP20tmXQ13vtj7voQnYOoSm/XN+t4n/H1i vkFwd2YghAErCKWm9fagZd7XLG2u7UAqcJRQQ7IAk87/4OCG3G7zk9U/c1QrWPipXZSF vQ6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682861702; x=1685453702; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Q66B2VAsNUEUORNlqd/SH3lXkCF0Wmvm/NkUzg1deG4=; b=keF/c3xaLd0rkmU5/zlWHFGUNvt4CEHT8382OLQP8ij88xKLd5igSN9tS9A6U1FqTf 734yN1rNTyawFERMit4Ej9xJJchTFM8JOIiE8jnU975QlLyAPr5GcF9e/9or3ODM4Qhx TMUYYJLVlbao24iT4atCIrjzZMVfSzYDkur4s2Oqod7hoSA1sZUH/lQuYpuvaGRI3Vck ATsmw3VSjaeCPugyzjAxaHgEohXZtnnUhUlRVHC7Kv5Px5Lx5NOPzF5QIo5DJbbRwccf ZkdXvRr5JnQluT/qVVoHEQAL599unA/wOkWBv6Qc1177/jirKuJ2GJ2ZaRnrmlIDLWj7 gWUg== X-Gm-Message-State: AC+VfDxYDAILyNgS30sIMTD1YDLbNN4D7mWqKXCjabGZQnCtrEvomNB0 pzmALCxfcI0HhTPn4CrjjFk= X-Google-Smtp-Source: ACHHUZ6f/Of5in+f+7rmLzDThrDRTY8P7ry/dx2mW37IvLwVIFHa0pZqc55OHMKJnZv46o13k/JELw== X-Received: by 2002:a05:600c:22d0:b0:3f0:7e15:f8fc with SMTP id 16-20020a05600c22d000b003f07e15f8fcmr8505350wmg.14.1682861702347; Sun, 30 Apr 2023 06:35:02 -0700 (PDT) Received: from localhost ([2a00:23c5:dc8c:8701:1663:9a35:5a7b:1d76]) by smtp.gmail.com with ESMTPSA id t24-20020a1c7718000000b003f3195be0a0sm10174326wmi.31.2023.04.30.06.35.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 30 Apr 2023 06:35:01 -0700 (PDT) Date: Sun, 30 Apr 2023 14:35:00 +0100 From: Lorenzo Stoakes To: "Liam R. Howlett" , Sven Schnelle , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton , syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com, stable@vger.kernel.org, linux-s390@vger.kernel.org Subject: Re: [PATCH] mm/mempolicy: Fix use-after-free of VMA iterator Message-ID: <5066f333-5021-451d-abdd-07a027d98820@lucifer.local> References: <20230410152205.2294819-1-Liam.Howlett@oracle.com> <20230427173247.s5rn6nujoxiatviu@revolver> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230427173247.s5rn6nujoxiatviu@revolver> X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 058CEC001C X-Stat-Signature: ntsk36pta4kt75wpj6h1p8w8rgc9ynpg X-HE-Tag: 1682861703-641816 X-HE-Meta: U2FsdGVkX1/soP8yWk5Swuz1b3MiHFlcCC6eLGbP7yEnR0uMYneMd0RE5TqM6cU0M8oYUYLQnETDNB1DGiLxzFj6K/l3GnfyBQOMl2AQcsO8xHOuFIvCSvWhIRhiPzxJxvQuti3+1rCeC+ibBFbXwH7BlqyBCDiKOLbKKfpdWBNnFzy6jP6c+HBRu+Oy4g7I1/mKNAFLLVatzbU+2oAkI66HSMcp8gCRIjZ6eVoYhCwrsxL8hsXIhkePdrqp0yaiXUuBvbp0jnTmqM/aWpigansGwqnKr4f1tWsxT7tJ7WBry2xtWsFAJM/dhQqeEHTp0rOK6fx3Q6Ql9bpfBjuWyA9BZSlZaC7k8fSiWA7jgiCvFsjbyVHljfE4KtxgZMe0H4OU7Y316R/Cu3P17P2g63kP/V81Jz73MhshTDeuVtZuFa8Q+ruU8cWn5F3kQTslkVqCS94vFvxFLlt1sfnUXsADlDI64vSOjjU6JMpSsYDASaMsSSMVnKSAI7Sy43qyG4Um/owhPJ6SZJrCW6fBJYdshVbRmt880yzMRrczH9akpKxy4qaN/nAjjJEaxtsQE1ufXd8pPZTGBcWqNgEscCoRNragiegx11fJjJxVzUAZWPt0PVNW8Rdu2svNpz1rAGQ6sr2t/hRy4VNg/JjAk0tXrywSXnPLRufRUTv3z4J4jrUaPaBRauzvwZ7CB9hw4ddI2eubim71QYw4p7V+gprZbcjvteP+2RCWQRKz9fRmXnBnTvUNi5fG0ATos+hdNNdaeYrb0HqVQ521tc0j1aAsE6l3iYFKobKKGTzu5njTSXT9HIq4CEc3MwAlLMmkLzv0d+Oa4Wamjcg4qebhb/TGEsVEciVaCxJavpmkyaEF5wAu8Fn3KAcIkrAilLgVqME0Z3Lb1YAHdWTQa7TIy2A+9l/p6UDMPWlp4YEuuSTPnBT7jtX9scX8GGFi5QqZG5DWevGeC0Ymr2RyCxU 0EfQ3nTN gSW3G+INTglMY18SDr2PHdmTSlcv6q98K4ubGwFHonE0u5NbLRG4BVZ1+aNhke4+d1T5sqHwdctsqAUpfybXWhsvdPtkKkl90gH9R0oXobtTE3eaiMGd/+uJu7QEbMsAwKzzpj+kaCgLNOGJu60dXfUBbXLScCqwt7bFecJ5TUsfgFoZCKPNA5oAomIfJnZmbYNtFUSS5kYb1J9iAhuc/0gWo+vgLyejlBXcpT/RP/skiZfPhg3Dy0Z3S0aIpiAZGL3bG9SGGTOyYxuV/bGjPLIi0IuGvQrZ1XYQLxeuuXTYZR4YVKBn//xsctUoPD+tCtrJcnywPqPKINqqJje4/ZE2joK8I9Ha9nkIv+Mp9xwyz0G6b0geNuviZkbV5DMqrGT1zskyEBFZVNahTlGOpT+gf3ZSy4Yl/sCRbAJWdSCF+deHzoKhLLOX1MACNkPMIKuJS5lpkI+nREq1bgS7O0l8+/9pqSrARCBN4jOpmpMAipzTDYBrBzoQIyQtANgdR/Bb/a9LGIyJ9ZF4tFMIl4L/T2g3psBB7Inq3An9gXzGM/GxE+zkc1fli/Kpfl4saZGHJK69q9BWmgaaSZ8DF9fJ/HnVMbUYojEZMzbB8skvMJ/O3HxFrnZNwe81DRaVns+eLdM1HB+pzE11Ah7+lWm6Lqvi2oXAMcIpFSv4w86jlXPEOD16iBSn3ItK2ntUNgSIgA/5+siBRvO0= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Apr 27, 2023 at 01:32:47PM -0400, Liam R. Howlett wrote: > * Sven Schnelle [230427 02:53]: > > "Liam R. Howlett" writes: > > > > > set_mempolicy_home_node() iterates over a list of VMAs and calls > > > mbind_range() on each VMA, which also iterates over the singular list of > > > the VMA passed in and potentially splits the VMA. Since the VMA > > > iterator is not passed through, set_mempolicy_home_node() may now point > > > to a stale node in the VMA tree. This can result in a UAF as reported > > > by syzbot. > > > > > > Avoid the stale maple tree node by passing the VMA iterator through to > > > the underlying call to split_vma(). > > > > > > mbind_range() is also overly complicated, since there are two calling > > > functions and one already handles iterating over the VMAs. Simplify > > > mbind_range() to only handle merging and splitting of the VMAs. > > > > > > Align the new loop in do_mbind() and existing loop in > > > set_mempolicy_home_node() to use the reduced mbind_range() function. > > > This allows for a single location of the range calculation and avoids > > > constantly looking up the previous VMA (since this is a loop over the > > > VMAs). > > > > > > Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@google.com/ > > > Reported-and-tested-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com > > > Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list") > > > Cc: > > > Signed-off-by: Liam R. Howlett > > > --- > > > > This breaks the vma02 testcase from ltp on s390: > > > > ~ # ./vma02 > > vma02 0 TINFO : pid = 617 addr = 0x3ff8f673000 > > vma02 0 TINFO : start = 0x3ff8f673000, end = 0x3ff8f674000 > > vma02 0 TINFO : start = 0x3ff8f674000, end = 0x3ff8f675000 > > vma02 0 TINFO : start = 0x3ff8f675000, end = 0x3ff8f676000 > > vma02 1 TFAIL : vma02.c:144: >1 unmerged VMAs. > > > > When this happens the following VM_WARN_ON() is triggered: > > > > [ 25.628747] ------------[ cut here ]------------ > > [ 25.628821] WARNING: CPU: 0 PID: 617 at mm/mmap.c:922 vma_merge+0x7ca/0x970 > > [ 25.628834] Modules linked in: > > [ 25.628841] CPU: 0 PID: 617 Comm: vma02 Not tainted 6.3.0-09574-g285e1dccc348 #108 > > [ 25.628846] Hardware name: IBM 3906 M04 704 (z/VM 7.1.0) > > [ 25.628850] Krnl PSW : 0704e00180000000 00000000004317b6 (vma_merge+0x7ce/0x970) > > [ 25.628859] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 > > [ 25.628866] Krnl GPRS: 000003ff8f62d000 000003ff8f674000 000000008e7cb908 000000000131f0f4 > > [ 25.628871] 0000000000000001 0000038000bdba1c 000003ff8f675000 000000008e7cb908 > > [ 25.628876] 000000008e7cb908 000003ff8f674000 000003ff8f675000 000000008e7ca308 > > [ 25.628881] 0000000000000001 000000003ff8f674 0000000000431048 0000038000bdbb08 > > [ 25.628891] Krnl Code: 00000000004317aa: a7f4fcea brc 15,000000000043117e > > [ 25.628891] 00000000004317ae: b9040087 lgr %r8,%r7 > > [ 25.628891] #00000000004317b2: af000000 mc 0,0 > > [ 25.628891] >00000000004317b6: a7f4fc5f brc 15,0000000000431074 > > [ 25.628891] 00000000004317ba: ec38fd30007c cgij %r3,0,8,000000000043121a > > [ 25.628891] 00000000004317c0: e31031d80004 lg %r1,472(%r3) > > [ 25.628891] 00000000004317c6: e310f0f80024 stg %r1,248(%r15) > > [ 25.628891] 00000000004317cc: a7f4fd27 brc 15,000000000043121a > > [ 25.628970] Call Trace: > > [ 25.628974] [<00000000004317b6>] vma_merge+0x7ce/0x970 > > [ 25.628979] ([<0000000000431048>] vma_merge+0x60/0x970) > > [ 25.628985] [<0000000000482e5a>] mbind_range+0x13a/0x1c8 > > [ 25.628990] [<0000000000483448>] do_mbind+0x2c8/0x448 > > [ 25.629013] [<0000000000483662>] kernel_mbind+0x9a/0xb8 > > [ 25.629018] [<0000000000483724>] __s390x_sys_mbind+0x4c/0x58 > > [ 25.629023] [<0000000000f38c3a>] __do_syscall+0x1da/0x208 > > [ 25.629030] [<0000000000f4ed40>] system_call+0x70/0x98 > > [ 25.629037] 1 lock held by vma02/617: > > [ 25.629042] #0: 000000008c570ca8 (&mm->mmap_lock){++++}-{3:3}, at: do_mbind+0x102/0x448 > > [ 25.629055] Last Breaking-Event-Address: > > [ 25.629058] [<0000000000431070>] vma_merge+0x88/0x970 > > [ 25.629066] irq event stamp: 12559 > > [ 25.629070] hardirqs last enabled at (12567): [<00000000001fcc6c>] __up_console_sem+0x8c/0xc0 > > [ 25.629080] hardirqs last disabled at (12574): [<00000000001fcc4e>] __up_console_sem+0x6e/0xc0 > > [ 25.629086] softirqs last enabled at (10076): [<0000000000f516e2>] __do_softirq+0x512/0x618 > > [ 25.629123] softirqs last disabled at (10053): [<0000000000162bbe>] __irq_exit_rcu+0x13e/0x170 > > [ 25.629132] ---[ end trace 0000000000000000 ]--- > > > > which is: > > > > /* verify some invariant that must be enforced by the caller */ > > VM_WARN_ON(prev && addr <= prev->vm_start); > > --> VM_WARN_ON(mid && end > mid->vm_end); > > VM_WARN_ON(addr >= end); > > > > Any thoughts? > > No thoughts that I should share. > > I will have to boot my s390 (vm) and have a look. > > Thanks for letting me know. > > Regards, > Liam I tracked down what this (almost certainly) was + added fix in [1] as it popped up as a 6.2.y stable bug. It doesn't seem arch-specific so you can put that s390 down :) [1]:https://lore.kernel.org/all/db42467a692d78c654ec5c1953329401bd8a9c34.1682859234.git.lstoakes@gmail.com/