From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5ACF8C3DA49 for ; Wed, 24 Jul 2024 02:24:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D7AC26B007B; Tue, 23 Jul 2024 22:24:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D2B626B0082; Tue, 23 Jul 2024 22:24:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C19696B0083; Tue, 23 Jul 2024 22:24:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id A9FB16B007B for ; Tue, 23 Jul 2024 22:24:30 -0400 (EDT) Received: from smtpin25.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 543D61205B5 for ; Wed, 24 Jul 2024 02:24:30 +0000 (UTC) X-FDA: 82373052300.25.91CCFBB Received: from out-175.mta1.migadu.com (out-175.mta1.migadu.com [95.215.58.175]) by imf13.hostedemail.com (Postfix) with ESMTP id 728DB20007 for ; Wed, 24 Jul 2024 02:24:28 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="ALgziQ//"; spf=pass (imf13.hostedemail.com: domain of muchun.song@linux.dev designates 95.215.58.175 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1721787821; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=EpolYlv0Jnv1Ymoo+FfzdPp8dy1j/5y+7C6zCgpN3ac=; b=YhwQsKheHnF0q8V6RyYq+NytRIST6OfizV+Vw511eOdMvnyWkc5H3z6bf/VI2qx5vnpWDS iJ6G6IiZnf4SBY4AmU/zCGKPgdfRVedOVUTG0lY8iqdvy7EMzEqdEchxZqD3KbzafmfCwV entJa+psiCYfYhz8iis40WZMEqVS0vY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1721787821; a=rsa-sha256; cv=none; b=6pR2c7czhSkV3oEh79UebaBZA1pQPWZGdwjDFutqmTt6Yw0ETFCyWpCifUufJY5YYTfKgk 1aNb6hpah9JaZeP4gQ511ZVZEjdDfpZ8FxeEQLP41l9QIB4lDCL6I6ZyN1NlxKHXNl3fIf igQSos9DiGcjqUzDMi+bIhYguL7ar5c= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b="ALgziQ//"; spf=pass (imf13.hostedemail.com: domain of muchun.song@linux.dev designates 95.215.58.175 as permitted sender) smtp.mailfrom=muchun.song@linux.dev; dmarc=pass (policy=none) header.from=linux.dev Content-Type: text/plain; charset=us-ascii DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1721787866; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=EpolYlv0Jnv1Ymoo+FfzdPp8dy1j/5y+7C6zCgpN3ac=; b=ALgziQ//EGixEzlmfUfTyzaAIpYyVX0IwvtL6gVujv50Ji/oypOgovc4ddjnCrf5LatyGW zbTbzlz7FrsxNqFXal5qeimKflmVYnqxvKo8BTjvX+zepZev4qJ6ICnvWDfQAMAggTxyA0 B29MieaNH1cWGXJqgJa0iVe84tgmrZg= Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.600.62\)) Subject: Re: [PATCH] mm: list_lru: fix UAF for memory cgroup X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song In-Reply-To: <20240723174540.18992614c476d77e7d9fb1e6@linux-foundation.org> Date: Wed, 24 Jul 2024 10:23:43 +0800 Cc: Muchun Song , Johannes Weiner , Nhat Pham , Linux Memory Management List , LKML Content-Transfer-Encoding: quoted-printable Message-Id: <62BBC2A6-D6C3-48B8-B049-932E3BC16F31@linux.dev> References: <20240718083607.42068-1-songmuchun@bytedance.com> <20240723174540.18992614c476d77e7d9fb1e6@linux-foundation.org> To: Andrew Morton X-Migadu-Flow: FLOW_OUT X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 728DB20007 X-Stat-Signature: pa1in14cj7ewjjsjk3pmm6kofgum75ik X-HE-Tag: 1721787868-302335 X-HE-Meta: U2FsdGVkX1+GHiFurC5wX6i0nrVGjcS9uYW4mC+jYgOYQYiVl2GKtlR1hBr/h2ajKD8xRR7J/eEGhkbmKZYIhWkBZ5ZiDz+jHFtdpN3j266n266hM3+LcffeqE1h9xMVq5HnRx3dDSY2EZEbWDz1JxGPRuvk8Rd5jQa684kO0bYOafPWAdChQv7qxgmQnkhFLML9lbGy5BGLjTZpn8DzmRpeH+ZaRMDzJyxeRx0OE1yUSMa0+iaHtU1yV5dMIbIvZsz0sEVgeBZu7a1PIVE6msRN6KK5D6p0G/9j/TZAgbjXkXf1oiJxbhcnelOvI3CWDVeO78NGg7cjXVQjoPCC5DGQTGcz6ALIOGgZyp9iC7KjNixdSzNq/SRcgBF1jnnULyvYJGb9BLdnZUtX1ss0oNNPPDFZPZmdh1fFlizqq7S1loXPGmPy8D2lQnDN3xmrkTfnbmHO6RxbYI93koc26fzi2ELqaMwzN9K87mHKWw2m0nALDWX6UmahQk90oXueNQwmoGfW8P1qmzoCPWP8NZzN9SZ/R3NUBCLa41PKoT1d60RHAnzQpWKhMKanHN1rDzJ76vw8a4V2wS0umj0neRquAVAlIagnR8iLw6hGEifdINNuZMDE0d9+ChGpzICGkTTOFA/UMptOPFy4a9duApzFXeCjiUEf7knPnmRbCSPIYxf6T3UsoRlGtOnX0JgK615/m2i4v6TJaqN/XWqrIqEcHm/Ti1b/354mD6VLm8q6wHd86zIzdADjAHVnJoJCl9bBugpzuscBuxY8DG6CBS+OmX7EXlwx529QYnN1zcgAG1MwJSghVUhxpt9JgNjPkVB35x7cUjN1b4ZTdaBu6newvPiRvpj6+0QPzFuEe/leNXXc8QYIz9mqzNYcUOVuOrLTGaestJC8fZxIW8Y3x0huJcvtrJixLqq6RGdNiaUc9zOvM2jaxpDGID/1Tz/TYUPY9GEvlNkrbpzlfGA 2pdzHAi4 dXUg+edb1ZOh7ALgvH3/m8GQaX1lSDLZbk/fu8EJSsJtUaCYzd4w/svPFYxnxC34V3idKi6D0LKod07o/byGpJ6WUGo6Qs/JUpMu5BFytdev9zw+saIvFw1jrYhFnqLIRWSJfIhp7pkYEH7hRc8+eEDFvtlwM1ceTs+ZWNymNfqNeJpGvwFV03a4jeSIFJbsIPWV/3LUOoPWOuUyViwbsk152OUnV8GBSwx4+oHspxa835BftpADrFQOXsXPbwpGhpkAWPomeME5oBSAUHcV+z25pWAky5XD+d3VAOFeGMiFOFANTS1/ocDdxYA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: > On Jul 24, 2024, at 08:45, Andrew Morton = wrote: >=20 > On Thu, 18 Jul 2024 16:36:07 +0800 Muchun Song = wrote: >=20 >> The mem_cgroup_from_slab_obj() is supposed to be called under rcu >> lock or cgroup_mutex or others which could prevent returned memcg >> from being freed. Fix it by adding missing rcu read lock. >=20 > "or others" is rather vague. What others? Like objcg_lock. I have added this one into obj_cgroup_memcg(). >=20 >> @@ -109,14 +110,20 @@ EXPORT_SYMBOL_GPL(list_lru_add); >>=20 >> bool list_lru_add_obj(struct list_lru *lru, struct list_head *item) >> { >> + bool ret; >> int nid =3D page_to_nid(virt_to_page(item)); >> - struct mem_cgroup *memcg =3D list_lru_memcg_aware(lru) ? >> - mem_cgroup_from_slab_obj(item) : NULL; >> + struct mem_cgroup *memcg; >>=20 >> - return list_lru_add(lru, item, nid, memcg); >> + rcu_read_lock(); >> + memcg =3D list_lru_memcg_aware(lru) ? = mem_cgroup_from_slab_obj(item) : NULL; >> + ret =3D list_lru_add(lru, item, nid, memcg); >> + rcu_read_unlock(); >=20 > We don't need rcu_read_lock() to evaluate NULL. >=20 > memcg =3D NULL; > if (list_lru_memcg_aware(lru)) { > rcu_read_lock(); > memcg =3D mem_cgroup_from_slab_obj(item); > rcu_read_unlock(); Actually, the access to memcg is in list_lru_add(), so the rcu lock = should also cover this function rather than only mem_cgroup_from_slab_obj(). Something like: memcg =3D NULL; if (list_lru_memcg_aware(lru)) { rcu_read_lock(); memcg =3D mem_cgroup_from_slab_obj(item); } ret =3D list_lru_add(lru, item, nid, memcg); if (list_lru_memcg_aware(lru)) rcu_read_unlock(); Not concise. I don't know if this is good. > } >=20 > Seems worthwhile? >=20 >=20