From: Dmitry Vyukov <dvyukov@google.com>
To: Andrew Morton <akpm@linux-foundation.org>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>,
Andrea Arcangeli <aarcange@redhat.com>,
Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Subject: mm: use-after-free in zap_page_range
Date: Fri, 3 Mar 2017 14:54:26 +0100 [thread overview]
Message-ID: <CACT4Y+YQscOM_H-gZqyzd7n79nUA3QM8=UsX55QEyoapn4QqdA@mail.gmail.com> (raw)
Hello,
Yesterday Andrea helped me to extend syzkaller descriptions to
accommodate the new userfaultfd features:
https://github.com/google/syzkaller/commit/e7fc37e3cc9909ac38afc13e4f00c299d05cabf5
And here we go. UFFDIO_API seems to be necessary to trigger this. If
you add new APIs don't neglect to add syzkaller descriptions as well.
The following program triggers use-after-free in zap_page_range:
https://gist.githubusercontent.com/dvyukov/b59dfbaa0cb1e5231094d228fa57c9bd/raw/95c4da18cb96f8aaa47c10012d8c4484fd5917ad/gistfile1.txt
BUG: KASAN: use-after-free in zap_page_range+0x552/0x5c0
mm/memory.c:1399 at addr ffff880064daa540
Read of size 8 by task a.out/11690
CPU: 0 PID: 11690 Comm: a.out Not tainted 4.10.0+ #269
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:331
zap_page_range+0x552/0x5c0 mm/memory.c:1399
madvise_dontneed mm/madvise.c:517 [inline]
madvise_vma mm/madvise.c:624 [inline]
SYSC_madvise mm/madvise.c:787 [inline]
SyS_madvise+0x6a0/0x1300 mm/madvise.c:716
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x43fdb9
RSP: 002b:00007f563994cd98 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043fdb9
RDX: 0000000000000004 RSI: 0000000000003000 RDI: 0000000020011000
RBP: 0000000000000000 R08: 00007f563994d700 R09: 0000000000000000
R10: 00007f563994d700 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f563994d9c0 R15: 00007f563994d700
Object at ffff880064daa500, in cache vm_area_struct size: 192
Allocated:
PID = 11686
kmem_cache_alloc+0x102/0x6e0 mm/slab.c:3571
kmem_cache_zalloc include/linux/slab.h:653 [inline]
mmap_region+0xa36/0x18f0 mm/mmap.c:1643
do_mmap+0x6a6/0xd40 mm/mmap.c:1453
do_mmap_pgoff include/linux/mm.h:2100 [inline]
vm_mmap_pgoff+0x206/0x280 mm/util.c:307
SYSC_mmap_pgoff mm/mmap.c:1503 [inline]
SyS_mmap_pgoff+0x22c/0x5d0 mm/mmap.c:1461
SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 11691
__cache_free mm/slab.c:3513 [inline]
kmem_cache_free+0x71/0x240 mm/slab.c:3773
remove_vma+0x162/0x1b0 mm/mmap.c:175
remove_vma_list mm/mmap.c:2443 [inline]
do_munmap+0x945/0xff0 mm/mmap.c:2674
mmap_region+0x69d/0x18f0 mm/mmap.c:1616
do_mmap+0x6a6/0xd40 mm/mmap.c:1453
do_mmap_pgoff include/linux/mm.h:2100 [inline]
vm_mmap_pgoff+0x206/0x280 mm/util.c:307
SYSC_mmap_pgoff mm/mmap.c:1503 [inline]
SyS_mmap_pgoff+0x22c/0x5d0 mm/mmap.c:1461
SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
entry_SYSCALL_64_fastpath+0x1f/0xc2
Memory state around the buggy address:
ffff880064daa400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064daa480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff880064daa500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880064daa580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff880064daa600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
On commit 4977ab6e92e267afe9d8f78438c3db330ca8434c
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2017-03-03 13:54 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-03 13:54 Dmitry Vyukov [this message]
2017-03-03 16:23 ` Andrea Arcangeli
2017-03-08 12:51 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CACT4Y+YQscOM_H-gZqyzd7n79nUA3QM8=UsX55QEyoapn4QqdA@mail.gmail.com' \
--to=dvyukov@google.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=aryabinin@virtuozzo.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox