From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BBFD1C25B78 for ; Tue, 28 May 2024 08:26:20 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2C34D6B0083; Tue, 28 May 2024 04:26:20 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 24C966B0088; Tue, 28 May 2024 04:26:20 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 113DF6B008A; Tue, 28 May 2024 04:26:20 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id E3F946B0083 for ; Tue, 28 May 2024 04:26:19 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 7B11A1403A5 for ; Tue, 28 May 2024 08:26:19 +0000 (UTC) X-FDA: 82167122478.23.7A86B76 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by imf03.hostedemail.com (Postfix) with ESMTP id CDD7C20019 for ; Tue, 28 May 2024 08:26:15 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf03.hostedemail.com: domain of mark.rutland@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=mark.rutland@arm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1716884776; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=7P1WPRopbz1l1mlvNPK568fey6uMWfytHCXv5jDcZck=; b=nG8oN5FIcbQtLA07NWT4O4UjiWHR5ZL8LwCmX2N2xGucwzGrxLw/cwK316/sYLu8r73Ugl kZUf534lTivv70tlsddHHl1GAzcERUc8K0Mz5gzdX6GYE9l+MD1BhZXwxdagBqQk2Llv+g 6u2flEF93b/F1Zks18RCHs5TXutyMII= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=arm.com; spf=pass (imf03.hostedemail.com: domain of mark.rutland@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=mark.rutland@arm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1716884776; a=rsa-sha256; cv=none; b=GSoCxrwk5iw7Wh77/yTWfay8zWl4962UMYW9VKrYE2GXt8DE1CoK35AZSr430pm9Tmm757 h08XE0+i4UHjTt0lPwzGIUSammlYZ35oHZUVvyMq9Ow5EKlUqd234q592F91odMKeQwTb9 cP5ngvJpjGmcBCst7LSpth6G6hh3bbw= Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D455C339; Tue, 28 May 2024 01:26:38 -0700 (PDT) Received: from J2N7QTR9R3 (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 71A4D3F641; Tue, 28 May 2024 01:26:11 -0700 (PDT) Date: Tue, 28 May 2024 09:26:04 +0100 From: Mark Rutland To: Barry Song <21cnbao@gmail.com>, Will Deacon Cc: akpm@linux-foundation.org, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Barry Song , Lance Yang , Ryan Roberts , David Hildenbrand , Jeff Xie , Kefeng Wang , Michal Hocko , Minchan Kim , Muchun Song , Peter Xu , Yang Shi , Yin Fengwei , Zach O'Keefe , Catalin Marinas Subject: Re: [PATCH] mm: arm64: Fix the out-of-bounds issue in contpte_clear_young_dirty_ptes Message-ID: References: <20240524005444.135417-1-21cnbao@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240524005444.135417-1-21cnbao@gmail.com> X-Rspamd-Queue-Id: CDD7C20019 X-Stat-Signature: ozsb31zd6pozi5w3pkzf88uda51mjbuy X-Rspam-User: X-Rspamd-Server: rspam08 X-HE-Tag: 1716884775-72249 X-HE-Meta: U2FsdGVkX19szBzwnzgJ7D0fi87F5X65eehDfX9a4aGPRhRVz11S2WEdX2aiNcPEZbPFA08UzztJuno97GzaE7k/sWOuIxtiBAzdFb4UfVrH7rjcU2PL5q6W/+vJ5X+Qyim7CeMhGjE0mcUrga6vmIXTAWqLMloIiMolu+eYd7clQ162oIZn4Frz3AjSk69bBmfoC7rROYKsJjryX3nYiRbkxk6JmpCMqzwmHYZa5Z0Rafb2wykcfNY/2QqsMd6wzweQ8gX3VGQBO8J5cwxFYD4kj1SRHSopbXxZUIBJr+zjasvLPz4wo7QYfmA60m4912mG5OHUjAEcutMzMBn04UkZ1fiui7YKbKB4Gw0oBkquY94aSiBb3bGSTAdsHXWULUEpMRjtJUtJU2wOaPy8mq7ikfbpSSVzcPzOLiHxxMQm9U+M88vN1OEXX2sSvp7PegUUG7UHpDagk3qz+whG/MDzfICMcUcNuMJwdDVMaEuQnV/S63zguP+jCk4XMrHo7TLKQkzowo/SpAkaepLJrxvPLp2XuKzuqKBVdz+GX5uwrNyfLu3W4Ux6jSNLddR4WyaDd0MlRIUve47XdVPiyFyO3Bjws4fU4O5C4jMIKjIRpP6rsEGYqF3s7BmbyXC1DnB863rOJXo5aQy+YbJIogOhHuYJ1dPaLwN0zs+srl1BP5jz/PdmPH9I7rF+AeEnw07SHgFXnNOTFHhPmp+h53begvfK5exOwdWKA9BTv6LYK3gDQrHBAlcPFTLA4c/oxZ5TduxSyLZ1+pAN/q511QASomFBYEtD4tUw48v3jYH5nmQRpx5W+ONHxgsNSYmEzjIe1JAXy9eO5TPE6Y/tYXs30w2mcifMqt6PLm14eSCZFFIeLHDnuD5vAJJMCjpJksAAmOYn7a+jjqtPYMJhmA/GUwHW0CG78W/9UgP42cQDHDOaLHXDWFBrMyw8h8q48f9cq4Yz0a+JUIm1FO6 KrRHovyI 1iLRnGCDWlZnnTZ8uqbT6Q/tCCE54LDorgfhM3Mw+KipnQyHgQwQQ4ir0T1buTirxP7DerlumdTD4WRxBiXAhqGWkW7+xTXpnZnS5qxMvDjtgOHimsrPKWu3qfOjqkXQD54AMqY3ELpRwAPj4De3DWk9F3JwQhqRiUDyP9o1AsUxGgE3AXhjUMJO5B9JVU0Q+jBtLVJ9gLq9YE9qdit6BAGeV00Ht1Kgdk4KvW6QKW5TvHRxDDsW8ZV/ioldPzhgH451J2pmTYWXncMfvIFPZ3N+gJZEwf7tvmKkIInm/cUigq8mfo4fUvkd9NizI9SzWkiBOhpfuxLF4fmNMLMLyomTs/gyzjJUM4lQ9ydwvMqmk/QyTz85VcZyO4xCT73nLmyWmuIs/QC60i2kSYXlYye01C04NPDPZH5i0gf9I2HC8Bru1x5lgl32Uw4HN7/uDwsMbVHy3NVxDQdaXmBfm/6WeN+cI8vqYXgpN7Odb/oUbA6qMyQVGDDP3zIX+0u5sBIPsGgDnD8J4GyMPxbPxI6DRCRkOtlvoWOb7jBRwJROy8HyxlfddWyJNvhF16UrIi1kjYIIKvLfvrQkbE3m9ge3fUw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Fri, May 24, 2024 at 12:54:44PM +1200, Barry Song wrote: > From: Barry Song > > We are passing a huge nr to __clear_young_dirty_ptes() right > now. While we should pass the number of pages, we are actually > passing CONT_PTE_SIZE. This is causing lots of crashes of > MADV_FREE, panic oops could vary everytime. > > Fixes: 89e86854fb0a ("mm/arm64: override clear_young_dirty_ptes() batch helper") I was seeing ths same thing on v6.10-rc1 (syzkaller splat and reproducer included at the end of the mail). The patch makes sense to me, and fixed the splat in testing, so: Reviewed-by: Mark Rutland Tested-by: Mark Rutland Since this only affects arm64 and is already in mainline, I assume the fix should go via the arm64 tree even though the broken commit went via mm. Mark. > Cc: Lance Yang > Cc: Barry Song <21cnbao@gmail.com> > Cc: Ryan Roberts > Cc: David Hildenbrand > Cc: Jeff Xie > Cc: Kefeng Wang > Cc: Michal Hocko > Cc: Minchan Kim > Cc: Muchun Song > Cc: Peter Xu > Cc: Yang Shi > Cc: Yin Fengwei > Cc: Zach O'Keefe > Cc: Catalin Marinas > Cc: Will Deacon > Signed-off-by: Barry Song > --- > arch/arm64/mm/contpte.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/mm/contpte.c b/arch/arm64/mm/contpte.c > index 9f9486de0004..a3edced29ac1 100644 > --- a/arch/arm64/mm/contpte.c > +++ b/arch/arm64/mm/contpte.c > @@ -376,7 +376,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > * clearing access/dirty for the whole block. > */ > unsigned long start = addr; > - unsigned long end = start + nr; > + unsigned long end = start + nr * PAGE_SIZE; > > if (pte_cont(__ptep_get(ptep + nr - 1))) > end = ALIGN(end, CONT_PTE_SIZE); > @@ -386,7 +386,7 @@ void contpte_clear_young_dirty_ptes(struct vm_area_struct *vma, > ptep = contpte_align_down(ptep); > } > > - __clear_young_dirty_ptes(vma, start, ptep, end - start, flags); > + __clear_young_dirty_ptes(vma, start, ptep, (end - start) / PAGE_SIZE, flags); > } > EXPORT_SYMBOL_GPL(contpte_clear_young_dirty_ptes); > > -- > 2.34.1 ---->8---- Syzkaller hit 'KASAN: use-after-free Read in contpte_clear_young_dirty_ptes' bug. ================================================================== BUG: KASAN: use-after-free in __ptep_get arch/arm64/include/asm/pgtable.h:315 [inline] BUG: KASAN: use-after-free in __clear_young_dirty_ptes arch/arm64/include/asm/pgtable.h:1309 [inline] BUG: KASAN: use-after-free in contpte_clear_young_dirty_ptes+0x264/0x288 arch/arm64/mm/contpte.c:389 Read of size 8 at addr ffff000018c0d000 by task syz-executor392/193 CPU: 0 PID: 193 Comm: syz-executor392 Not tainted 6.10.0-rc1-00001-g30b7f99b25b6 #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x12c/0x1f8 arch/arm64/kernel/stacktrace.c:317 show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x184/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xf4/0x5b0 mm/kasan/report.c:488 kasan_report+0xc0/0x100 mm/kasan/report.c:601 __asan_report_load8_noabort+0x20/0x30 mm/kasan/report_generic.c:381 __ptep_get arch/arm64/include/asm/pgtable.h:315 [inline] __clear_young_dirty_ptes arch/arm64/include/asm/pgtable.h:1309 [inline] contpte_clear_young_dirty_ptes+0x264/0x288 arch/arm64/mm/contpte.c:389 clear_young_dirty_ptes arch/arm64/include/asm/pgtable.h:1715 [inline] madvise_free_pte_range+0xa5c/0x16d8 mm/madvise.c:767 walk_pmd_range mm/pagewalk.c:143 [inline] walk_pud_range mm/pagewalk.c:221 [inline] walk_p4d_range mm/pagewalk.c:256 [inline] walk_pgd_range+0xca4/0x1900 mm/pagewalk.c:293 __walk_page_range+0x4bc/0x5b8 mm/pagewalk.c:395 walk_page_range+0x4a4/0x840 mm/pagewalk.c:521 madvise_free_single_vma+0x3a0/0x798 mm/madvise.c:815 madvise_dontneed_free mm/madvise.c:929 [inline] madvise_vma_behavior mm/madvise.c:1046 [inline] madvise_walk_vmas mm/madvise.c:1268 [inline] do_madvise+0x54c/0x2990 mm/madvise.c:1464 __do_sys_madvise mm/madvise.c:1481 [inline] __se_sys_madvise mm/madvise.c:1479 [inline] __arm64_sys_madvise+0x94/0xf8 mm/madvise.c:1479 __invoke_syscall arch/arm64/kernel/syscall.c:34 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:48 el0_svc_common.constprop.0+0xec/0x2a8 arch/arm64/kernel/syscall.c:133 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:152 el0_svc+0x54/0x160 arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x120/0x130 arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:598 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58c0d flags: 0x3fffe0000000000(node=0|zone=0|lastcpupid=0x1ffff) raw: 03fffe0000000000 fffffdffc0630388 fffffdffc071cc48 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000018c0cf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff000018c0cf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff000018c0d000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff000018c0d080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff000018c0d100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Syzkaller reproducer: # {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}} madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x17) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0) mprotect(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x8) C reproducer: // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #ifndef __NR_madvise #define __NR_madvise 233 #endif #ifndef __NR_mmap #define __NR_mmap 222 #endif #ifndef __NR_mprotect #define __NR_mprotect 226 #endif int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/-1, /*offset=*/0ul); if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {} syscall(__NR_madvise, /*addr=*/0x20ffd000ul, /*len=*/0x3000ul, /*advice=MADV_POPULATE_WRITE*/0x17ul); syscall(__NR_mprotect, /*addr=*/0x20ffc000ul, /*len=*/0x4000ul, /*prot=*/0ul); syscall(__NR_mprotect, /*addr=*/0x20800000ul, /*len=*/0x800000ul, /*prot=PROT_READ*/1ul); syscall(__NR_madvise, /*addr=*/0x20400000ul, /*len=*/0xc00000ul, /*advice=*/8ul); return 0; }