From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D3C0C02188 for ; Mon, 27 Jan 2025 17:08:28 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9821B280189; Mon, 27 Jan 2025 12:08:27 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 8E18B280185; Mon, 27 Jan 2025 12:08:27 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 75C37280189; Mon, 27 Jan 2025 12:08:27 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 57E7B280185 for ; Mon, 27 Jan 2025 12:08:27 -0500 (EST) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id CB4C2B0207 for ; Mon, 27 Jan 2025 17:08:26 +0000 (UTC) X-FDA: 83053865412.18.C4573EB Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf22.hostedemail.com (Postfix) with ESMTP id 05C29C0012 for ; Mon, 27 Jan 2025 17:08:24 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b="nQ69Vy/A"; spf=none (imf22.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1737997705; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2dPWRjFb8yCXJpAGicb+5JCs45LQ7/H/zcxH8kFVcAU=; b=kEDDC+aMcVZqdsQ2l8RZr238lMagPJMXBPd+LAMUSo/3DzV7i67B0rFAHyNu7tsbXPwAx2 TwgK28owhApyensr0zD6qDhbmJfVXcxMWeZniVEsRVyZBwU+Fc3usbmLGU4N3St3WVJRIS J1Ze/E5oVFnpw/0+Q77YsdUfXa5Ehys= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b="nQ69Vy/A"; spf=none (imf22.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1737997705; a=rsa-sha256; cv=none; b=fFk8eCk1gvpSrE048GD32C5+XEdSqVNxNtCZ11k7MD9smuSwuw72MW2Px7OcehOR1MugIE e6G5Hk52facyzTso4KM7GGfyFIOCMvPGxf34fcdixAbsQnV6m3pjTZuohaOBOaPSYpi4Df RJu34qaOOpSnZj4W6Haxd3efSofXp2s= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=2dPWRjFb8yCXJpAGicb+5JCs45LQ7/H/zcxH8kFVcAU=; b=nQ69Vy/A2wCPbl/pRTrrin/I/k BjrN2xZk5QIyA1xklnpys3slA38hO/gXybvXl14vu/xFfBFHg2D3ly0swjxAWc8sVUQEFG+WPoG21 O1avVBq7P86Fbh6YqLywIsfksnKEFj0S40jTKReU7u5IqBCCrG7ZMFKyrsXJr54j5bntLpGHPpIsJ 5ijc94VDyf+AztLCzy307ihHif8KxEEVufglF40RAa8Xr9vaY0lWQvK6VjvEA6kqe7ZJyjmqYX1It S2Th4tbrG0zySUGxA18DIXgrc9+R1Hxtg55zf/ZnQxGL9PW+wiC8c7kAbg5m0uclCp1EWRvcY6wLz 1YW+4IcA==; Received: from willy by casper.infradead.org with local (Exim 4.98 #2 (Red Hat Linux)) id 1tcSax-00000009gpB-1q2F; Mon, 27 Jan 2025 17:08:19 +0000 Date: Mon, 27 Jan 2025 17:08:19 +0000 From: Matthew Wilcox To: "Liam R. Howlett" Cc: Andrew Morton , maple-tree@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Oleg Nesterov , Masami Hiramatsu , Jann Horn , Lorenzo Stoakes , Peter Zijlstra , Michal Hocko , Peng Zhang Subject: Re: [PATCH v2] kernel: Be more careful about dup_mmap() failures and uprobe registering Message-ID: References: <20250127170221.1761366-1-Liam.Howlett@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250127170221.1761366-1-Liam.Howlett@oracle.com> X-Rspamd-Queue-Id: 05C29C0012 X-Stat-Signature: sunofqfzubur44mex5sp83739gjon4nh X-Rspamd-Server: rspam08 X-Rspam-User: X-HE-Tag: 1737997704-311861 X-HE-Meta: U2FsdGVkX1/15CtgEyKji8ofAs+37rvYDgunamhzNlorFFEoCeSAtfFTHI/pNksgeaAavBoQmOX7QxmLPKbIn8ZI1duL1PJ/qogGlOVk2jf9OuIy4OSTTp1kg9/lYSpGiWweINIMDjJw2p6Cpi5fGCIAojOtX8eBnuGsTjviIzaHo5FxjyLQN3YchoaC8KnLVjQMdBFgGfU3yCyhm371WCuTTlagqle7uZIcezfrZEewRu3sGH3aYloJtnJdSREs2viKwc9ajXmuiJnZV2zAmcXvk5rCCoOe+XlUrO3MfJAMZfmTTtY0r5zeqnODj2olEN7BhV3DtIuK8rnX1WYTzkdLrkRq4kb5thnNFVhLE3HWcFexswZL8PjxmOcns7w9vgod50eIu6whLGV83bORM6pAsbWoMhk2qpkRgjSwdF6RUxrMHFW/yhaP0H6qQJqMbwWAWvx0JK+wnkd53BUMsivmNsvKv1RsbJRoHEbx4lY/ItqoXJbZJe0qlRb4zw83aMRX0WYBU9Jhrs/Avq3+q5kx3wAsFGu1SmJaalLYYt95QH491xgFZmdYhLOytLlQb/iTZ8X+q2IFGStUza6f+7W21mnCxNZce592Eyj1RB4pnrBzIG5freSiBJqfgI62omxNB+/0WYeOrBrDspke1zoqfjfTHUO0hMhpoIV5GPJLcxPITk9y1KJsXJROZ/gFK2W/pJMVVxWTuOTxEBQMBYo5Fe/MEBlxd7/aqa/uWncPdonG+eGex4liZCHRq8lAELC5OBi2SMgAAHudTEKN+WV94yrzivP8uI8e28/6N9zGwMkFOzmBrMWtJBsXqVrJIaeWFA/wXB+rvTP5RQ/eHQLCKLsHH3GdYpijBdUgRbMFf+NpWDfzUaB2gEfUKr1uNKakmQvOs9SBvIPwyjJBgDkIBVwfp09jU3U6jW8cPHWfociTHYmcqxOdIKlUHrF9gFgVyiJi4ZB9koEJmQo AByz7zpN tyZWwNR9lj/H5f+EJgVd3hjgrOB+DNhO5d2UHpZVEUgrV6lyi28kgVQwPFRxripN5YiqtU59NJP1DDmW0uNj92BT6+/oxw7TGGSQKuNJFyMb5P4soNNeIw4W1uYc4v0DAlkvuMgljp9NpkGfNbzrgW0DuOWuiIHx+F9FdwxXk7kkfWUs6GjTCIH1zz1ye2QNdXVTBx63k7M8EkeIrfUJ/vO6HcAu+mO2NEAugW0TNRGLO3OVZB2Ys5h6Y/QeAMWMrFQqPq/Rdb9SJ8vizF6avFyvE0Az/6jhUBsmQfDAAfbhsxRuBNQaYezjiHRBS5GbfuMKtMSNt/ofhHrUgINVXkMbvWPs5VbSxWPVkbPP76HoR8W+kDdmCoetST4NlauVpuOS+3L1kyvee5lOdpjrnYK9s3L49Iq0iJYgjeMwI4kRcbzUtlCJ8i8Ezo/sUrcyqOPRonhztFSca8IHJY3P/bPVhik5KJBBVNhGiy6KBKTxMs8uigYDGQsONrgrJnvKyvi0J X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Jan 27, 2025 at 12:02:21PM -0500, Liam R. Howlett wrote: > From: "Liam R. Howlett" > > In the even that there is a failure during dup_mmap(), the maple tree "event". Although the writing is a little clumsy here. You could just say "If there is a failure". But that begs the question of what kind of failure, and I think it's only a memory allocation failure? So you could say "If a memory allocation fails during dup_mmap()," > can be left in an unsafe state for other iterators besides the exit > path. All the locks are dropped before the exit_mmap() call (in > mm/mmap.c), but the incomplete mm_struct can be reached through (at > least) the rmap finding the vmas which have a pointer back to the > mm_struct. > > Up to this point, there have been no issues with being able to find an > mm_struct that was only partially initialised. Syzbot was able to make > the incomplete mm_struct fail with recent forking changes, so it has > been proven unsafe to use the mm_struct that hasn't been initialised, as > referenced in the link below. > > Although 8ac662f5da19f ("fork: avoid inappropriate uprobe access to > invalid mm") fixed the uprobe access, it does not completely remove the > race. > > This patch sets the MMF_OOM_SKIP to avoid the iteration of the vmas on > the oom side (even though this is extremely unlikely to be selected as > an oom victim in the race window), and sets MMF_UNSTABLE to avoid other > potential users from using a partially initialised mm_struct. > > When registering vmas for uprobe, skip the vmas in an mm that is marked > unstable. Modifying a vma in an unstable mm may cause issues if the mm > isn't fully initialised. > > Link: https://lore.kernel.org/all/6756d273.050a0220.2477f.003d.GAE@google.com/ > Fixes: d240629148377 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") > Cc: Oleg Nesterov > Cc: Masami Hiramatsu > Cc: Jann Horn > Cc: Lorenzo Stoakes > Cc: Peter Zijlstra > Cc: Michal Hocko > Cc: Peng Zhang > Signed-off-by: Liam R. Howlett > --- > > v1: https://lore.kernel.org/all/20250123205849.793810-1-Liam.Howlett@oracle.com/ > > Changes since: > v1 > - Added check_stable_address_space() to uprobe code - Thanks Lorenzo > - Added Oleg & Masami to Cc list. > > kernel/events/uprobes.c | 4 ++++ > kernel/fork.c | 17 ++++++++++++++--- > 2 files changed, 18 insertions(+), 3 deletions(-) > > diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c > index fa04b14a7d723..90ebcdbad05ca 100644 > --- a/kernel/events/uprobes.c > +++ b/kernel/events/uprobes.c > @@ -28,6 +28,7 @@ > #include > #include > #include > +#include /* check_stable_address_space */ > > #include > > @@ -1260,6 +1261,9 @@ register_for_each_vma(struct uprobe *uprobe, struct uprobe_consumer *new) > * returns NULL in find_active_uprobe_rcu(). > */ > mmap_write_lock(mm); > + if (check_stable_address_space(mm)) > + goto unlock; > + > vma = find_vma(mm, info->vaddr); > if (!vma || !valid_vma(vma, is_register) || > file_inode(vma->vm_file) != uprobe->inode) > diff --git a/kernel/fork.c b/kernel/fork.c > index ded49f18cd95c..20b2120f019ca 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -760,7 +760,8 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, > mt_set_in_rcu(vmi.mas.tree); > ksm_fork(mm, oldmm); > khugepaged_fork(mm, oldmm); > - } else if (mpnt) { > + } else { > + > /* > * The entire maple tree has already been duplicated. If the > * mmap duplication fails, mark the failure point with > @@ -768,8 +769,18 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, > * stop releasing VMAs that have not been duplicated after this > * point. > */ > - mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); > - mas_store(&vmi.mas, XA_ZERO_ENTRY); > + if (mpnt) { > + mas_set_range(&vmi.mas, mpnt->vm_start, mpnt->vm_end - 1); > + mas_store(&vmi.mas, XA_ZERO_ENTRY); > + /* Avoid OOM iterating a broken tree */ > + set_bit(MMF_OOM_SKIP, &mm->flags); > + } > + /* > + * The mm_struct is going to exit, but the locks will be dropped > + * first. Set the mm_struct as unstable is advisable as it is > + * not fully initialised. > + */ > + set_bit(MMF_UNSTABLE, &mm->flags); > } > out: > mmap_write_unlock(mm); > -- > 2.43.0 > > > -- > maple-tree mailing list > maple-tree@lists.infradead.org > https://lists.infradead.org/mailman/listinfo/maple-tree