From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBB35C433EF for ; Tue, 22 Feb 2022 05:41:43 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 730F58D0002; Tue, 22 Feb 2022 00:41:43 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 6B98E8D0001; Tue, 22 Feb 2022 00:41:43 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 511208D0002; Tue, 22 Feb 2022 00:41:43 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0148.hostedemail.com [216.40.44.148]) by kanga.kvack.org (Postfix) with ESMTP id 3F2C18D0001 for ; Tue, 22 Feb 2022 00:41:43 -0500 (EST) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 00C018249980 for ; Tue, 22 Feb 2022 05:41:42 +0000 (UTC) X-FDA: 79169318886.17.8C2D20F Received: from mail-yb1-f182.google.com (mail-yb1-f182.google.com [209.85.219.182]) by imf03.hostedemail.com (Postfix) with ESMTP id 7974020006 for ; Tue, 22 Feb 2022 05:41:42 +0000 (UTC) Received: by mail-yb1-f182.google.com with SMTP id y6so38773223ybc.5 for ; Mon, 21 Feb 2022 21:41:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q3j1v/ieMhWWZ8B1LjbJFMKNN3+pYWRoz3JVkgTF+2M=; b=IzgCNKJMkd3X18WfrRnx1/vbPzn5YqpZRgWbvXhcTGrcSjf5mZ70iqEEHP/IjEevxA kTkpugo6dJAc/ZGigkizl54+/Oy+aXpsCbo8CyXJFquQJfVWKNVv48ns4e5hrcKt58ll UEM21waFMiJQ1LMPMQm9OtRYmAuAfDDkMCcbAjdzSgeN0MuqbiAHzg+ujppAev0s5As+ K9/QlTUQwd90lyNhgYuDjDt2ELLauUcadRrQNKvnha9Bl8tg1mmTkKgVzCEWyrjbSdXO GsR66v522BrQRGNS2107poTKqJ9WqNMvTU+LvoBRuhb5LNjY80TNWCzivd33Jr84LQAP NGrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q3j1v/ieMhWWZ8B1LjbJFMKNN3+pYWRoz3JVkgTF+2M=; b=Kf3mvo5b0X4YsQutyVNmF0LxOm4H/eSvLpiFIDbDik98T4BslIsZJz42Tb+OOoXR28 Xv3ZKRaKlbdjYjg2zbcNzxotaFfWNucNaZC5rr/kq2kEPMX3jzt19g7Oqt1OZayV4lbj 5wPQea+0HA7YGyYs4qvk2VauEFKEf5NKwh6b+/u+s+xy057O54GwYl5Ayc2SzznpAdJL D/CAkUbaqaRQsZwwoWkPxhYplIzlLaybb+cVMhpDfcvW/7jXSGVYc8Q/HbkajVrpLSVC 3R26SNAbD2aiq3s7fTe/yDUY3GojYfsupoGJMx/hZh89jFDROnQDU/lutmrSwV4k5o7b 7r+w== X-Gm-Message-State: AOAM530AJoWPAWt9wGFuhdOt86SqUawZVjDduuBBJ9/rKUq7sJeedca0 1xKNRfhCHgMhmm3rU3gWswFSa5WD0eeqMwWnO8cdww== X-Google-Smtp-Source: ABdhPJzRzwoQ5s6qyAHP8/WqFbpiNGqoLzw7CNXZasSgjjaB7Va0jlhjUkvhdql7d7H/JNlR02DnTOEVVLEiVzYdZ78= X-Received: by 2002:a25:2693:0:b0:624:50a8:fee9 with SMTP id m141-20020a252693000000b0062450a8fee9mr15135617ybm.348.1645508501550; Mon, 21 Feb 2022 21:41:41 -0800 (PST) MIME-Version: 1.0 References: <20220222054025.3412898-1-surenb@google.com> <20220222054025.3412898-3-surenb@google.com> In-Reply-To: <20220222054025.3412898-3-surenb@google.com> From: Suren Baghdasaryan Date: Mon, 21 Feb 2022 21:41:30 -0800 Message-ID: Subject: Re: [PATCH v4 3/3] mm: fix use-after-free when anon vma name is used after vma is freed To: akpm@linux-foundation.org Cc: ccross@google.com, sumit.semwal@linaro.org, mhocko@suse.com, dave.hansen@intel.com, keescook@chromium.org, willy@infradead.org, kirill.shutemov@linux.intel.com, vbabka@suse.cz, hannes@cmpxchg.org, ebiederm@xmission.com, brauner@kernel.org, legion@kernel.org, ran.xiaokai@zte.com.cn, sashal@kernel.org, chris.hyser@oracle.com, dave@stgolabs.net, pcc@google.com, caoxiaofeng@yulong.com, david@redhat.com, gorcunov@gmail.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com Content-Type: text/plain; charset="UTF-8" Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=IzgCNKJM; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf03.hostedemail.com: domain of surenb@google.com designates 209.85.219.182 as permitted sender) smtp.mailfrom=surenb@google.com X-Rspam-User: X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: 7974020006 X-Stat-Signature: 8omakmbdn7x51j1wdc3ihp8ad8719h87 X-HE-Tag: 1645508502-506231 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Feb 21, 2022 at 9:40 PM Suren Baghdasaryan wrote: > > When adjacent vmas are being merged it can result in the vma that was > originally passed to madvise_update_vma being destroyed. In the current > implementation, the name parameter passed to madvise_update_vma points > directly to vma->anon_name->name and it is used after the call to > vma_merge. In the cases when vma_merge merges the original vma and > destroys it, this will result in use-after-free bug as shown below: > > madvise_vma_behavior << passes vma->anon_name->name as name param > madvise_update_vma(name) > vma_merge > __vma_adjust > vm_area_free <-- frees the vma > replace_vma_anon_name(name) <-- UAF > > Fix this by raising the name refcount and stabilizing it. > > Fixes: 9a10064f5625 ("mm: add a field to store names for private anonymous memory") > Signed-off-by: Suren Baghdasaryan > Reported-by: syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com > --- > changes in v3: > - Reapplied the fix after code refactoring, per Michal Hocko Hi Andrew, Since I needed to make some refactoring before adding this fix, in order to apply this new version to mmotm you would need to revert the previous version of this patch from your tree: 0cc16837d264 ("mm: fix use-after-free when anon vma name is used after vma is freed") and then apply the whole patchset (3 patches) after it is reviewed. Sorry for the inconvenience but I think this way the refactoring and the fix would be in the right order and with no overlap. The patchset applies cleanly to Linus' ToT and to mmotm after 0cc16837d264 is reverted. Thanks, Suren. > > mm/madvise.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/mm/madvise.c b/mm/madvise.c > index a395884aeecb..00e8105430e9 100644 > --- a/mm/madvise.c > +++ b/mm/madvise.c > @@ -140,6 +140,8 @@ static int replace_vma_anon_name(struct vm_area_struct *vma, > /* > * Update the vm_flags on region of a vma, splitting it or merging it as > * necessary. Must be called with mmap_sem held for writing; > + * Caller should ensure anon_name stability by raising its refcount even when > + * anon_name belongs to a valid vma because this function might free that vma. > */ > static int madvise_update_vma(struct vm_area_struct *vma, > struct vm_area_struct **prev, unsigned long start, > @@ -1021,8 +1023,10 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, > } > > anon_name = vma_anon_name(vma); > + anon_vma_name_get(anon_name); > error = madvise_update_vma(vma, prev, start, end, new_flags, > anon_name); > + anon_vma_name_put(anon_name); > > out: > /* > -- > 2.35.1.473.g83b2b277ed-goog >