From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0D01C77B73 for ; Mon, 1 May 2023 18:25:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 337F4900003; Mon, 1 May 2023 14:25:01 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2E821900002; Mon, 1 May 2023 14:25:01 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1AF71900003; Mon, 1 May 2023 14:25:01 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 08016900002 for ; Mon, 1 May 2023 14:25:01 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 58359A07B3 for ; Mon, 1 May 2023 18:25:00 +0000 (UTC) X-FDA: 80742512760.06.279B013 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by imf08.hostedemail.com (Postfix) with ESMTP id AB9F2160019 for ; Mon, 1 May 2023 18:24:56 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b=F+F8+DQR; spf=pass (imf08.hostedemail.com: domain of svens@linux.ibm.com designates 148.163.156.1 as permitted sender) smtp.mailfrom=svens@linux.ibm.com; dmarc=pass (policy=none) header.from=ibm.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682965497; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=xx/3hJ+CZLlHDK4Ntj3hDqtJoR/nQrjMLEvEL6by9H4=; b=aEvlSCNSaBCeO68fnO5y6ikAZdkeOX3HS409xg5PlP3pPF1sznDK3p5Wyl41P4w6dOM4Eh +ySPVC7BGSuLBsOJWyOSZa6LWXnb0oRmeK50NFyvCAEZbeVlaApsWZJY1NM9psq1nPIn7U 7k7he0eYDfsmbYecsE6Rv3C2fLHn1wU= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=ibm.com header.s=pp1 header.b=F+F8+DQR; spf=pass (imf08.hostedemail.com: domain of svens@linux.ibm.com designates 148.163.156.1 as permitted sender) smtp.mailfrom=svens@linux.ibm.com; dmarc=pass (policy=none) header.from=ibm.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1682965497; a=rsa-sha256; cv=none; b=1BR5EX26VFedAIBFSy+WM78dOZKMvfHfQsjDQwD1y0eDKtworsgsG/CqMIhNjVPJme9U2D LKHjSmVx6J4dJX7Su/fQE/HPEw521bk0OdsKUq3CuPmbpT77X5O0WUHmF0avSINgMoAVBv htghPKp/3lqBrR8Ve9wpQBskHCjYeAs= Received: from pps.filterd (m0353726.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 341IMVxm007847; Mon, 1 May 2023 18:24:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : references : date : in-reply-to : message-id : content-type : mime-version; s=pp1; bh=xx/3hJ+CZLlHDK4Ntj3hDqtJoR/nQrjMLEvEL6by9H4=; b=F+F8+DQR5I0Lm1ickWftFgEacrG1b/Ob/c5wd/dzo7OBlR9FvuNaVEzqvffXWqFDjhtG zVYDBoqxEZF8rO81m6gXAxiFSDatiUG01Gcg4rCudQrF2pbK6t+7opVOCl6APEzXigMJ LOXlCg30KOj9Tjwhe4fvnT9lj9it9jnHAkCxhHq1SuhkK7zjLsLfFiSTGpEKYhKZnOzn qdz0kVXBQ+WBxGmOSZ2osQhypxmohknKJPKXravQ54DtrVj5XLU1N5fZ1zZNpRx3/6Eg nWi14x+ViFrkp9Zp09ct3bjbJeepDyCdIXbIjP2tajfFfZzsogSa0UwAZO4poHoRPK8l 0Q== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3qafew5m7r-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 01 May 2023 18:24:54 +0000 Received: from m0353726.ppops.net (m0353726.ppops.net [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 341IKHb6001603; Mon, 1 May 2023 18:24:54 GMT Received: from ppma01fra.de.ibm.com (46.49.7a9f.ip4.static.sl-reverse.com [159.122.73.70]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3qafew5m6t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 01 May 2023 18:24:54 +0000 Received: from pps.filterd (ppma01fra.de.ibm.com [127.0.0.1]) by ppma01fra.de.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 341IOpDa023238; Mon, 1 May 2023 18:24:51 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma01fra.de.ibm.com (PPS) with ESMTPS id 3q8tv6ry5t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 01 May 2023 18:24:51 +0000 Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 341IOn3H13632224 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Mon, 1 May 2023 18:24:49 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 237752004B; Mon, 1 May 2023 18:24:49 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C6B2E20043; Mon, 1 May 2023 18:24:48 +0000 (GMT) Received: from tuxmaker.linux.ibm.com (unknown [9.152.85.9]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTPS; Mon, 1 May 2023 18:24:48 +0000 (GMT) From: Sven Schnelle To: Lorenzo Stoakes Cc: "Liam R. Howlett" , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton , syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com, stable@vger.kernel.org, linux-s390@vger.kernel.org Subject: Re: [PATCH] mm/mempolicy: Fix use-after-free of VMA iterator References: <20230410152205.2294819-1-Liam.Howlett@oracle.com> <20230427173247.s5rn6nujoxiatviu@revolver> <5066f333-5021-451d-abdd-07a027d98820@lucifer.local> Date: Mon, 01 May 2023 20:24:48 +0200 In-Reply-To: <5066f333-5021-451d-abdd-07a027d98820@lucifer.local> (Lorenzo Stoakes's message of "Sun, 30 Apr 2023 14:35:00 +0100") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) Content-Type: text/plain X-TM-AS-GCONF: 00 X-Proofpoint-GUID: VBYajAsBVtX0SqlJLITO9ZYUcqVVGhgr X-Proofpoint-ORIG-GUID: PIwNWU_xoEM_aeOrGETdiN8XcYyNn6Jb X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22 definitions=2023-05-01_10,2023-04-27_01,2023-02-09_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 phishscore=0 mlxlogscore=783 suspectscore=0 adultscore=0 lowpriorityscore=0 mlxscore=0 clxscore=1015 priorityscore=1501 spamscore=0 bulkscore=0 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000 definitions=main-2305010148 X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: AB9F2160019 X-Rspam-User: X-Stat-Signature: x8hejwzsk4frwqeq88woe49859ptxuxo X-HE-Tag: 1682965496-248577 X-HE-Meta: U2FsdGVkX1+iSTh3dBYapM3/TSG/kCABMJQAjl3r7Ai/+BOpCAhiu9wHGxeVYODBBC3zl90Qq87qlfm1uEcX1raEMSgoBPZu8FMxTbP2l+42xqJlUUFSkb4jk1L6etaPVNMKHpjXlcuJvA/oCchFGKTryPzj/3wH6AkdGg9QYZGdiYTw8rQyuM+prChGEI02EBQSqqKoXELwTIDO4B2TEWMnajuRwM7jMNgVOhRL5bfvZyot3g5bZCXlJWQ21E7vpmkaOzbUmL8wBwSl0KheuBLxMv6ifkBPHwd3aYmHG0WpQAFF80YEefO+Q9z7hEAX60QbPttkilEFsJH1jqDR3jcdgqMAoGDFtbA2GeohV2J7pmhOv+ngkUHyX29ZzZbzQSqKitVjHIBnxisf3B/WOpzz7ZiDApP1GiBkvJVLR7sAamFdlTFoIDWxjCe1kr1ufoXoA5G+gVHm29j3N4cAI/2x9DQ7YR2jvCn9JhyrZzqMdpX9CZeFcXL7ufQ3SU+wGV3bYfWGMJE17712ZDMVS6tWW6KQRn/BaZboENw5bMJhbi3i4xVxCNLZ51m/2FrVc1D9mXOHafb5EuB3CsQMu+ZOO4/2lMmGNUhC043gciUWh2F2LehWjrjzcAzTi9/8NmdN/aX2m8KcKqqV47yvYkiYM84bezqScKLS+7g8cIPKPWXWhxH9njICZdXcAyKTkjanubTB6dmeIxyr/+vV2xG4c2JnsA0gys7GA4wcaLpQUq/cPA+FCtWjs/lpUhzIi3qmLLCrEUk34Fo6irjVmiEnW/58wgiQOBl/UK1Gt5RXZTK3sd2eBmFWWCeeNErhyxd6MOyE8LMXi5IitzeXenU7f6vzKCiBzx66o7GDE9Z+lwuZDwXvQcvfyqYJYfQY4Eje+B3sjXVB0sMVng8ItqO/jc/9GJAyR7Sv6gg+3OZwq87dUV+CEDGQyv+mThLdK0NCw2oC2P0AaNowdc4 +gZDXbqp RNTkBzytFRKvaT8bRlEIYZ8hXwS0nP0gOq6J1a/GXl+jPwSURkMy+vc62kubxDCl4ITMF0k8IFdR8vn9e9jBzym/HgFGRsTQAl71ReJGpLRTURksb+yp4H/YKDOUIky4r22o07Nsq0BbUPsctnfjLEvFdXemwkhvl/BO9qWqxIzib5qY6jg+BIcNBg+37OjFbkfPmUZS0O5MgHxIvR950oVMRFWFCKZqBKrU0sGeDgLiVKcn35173wjdJrqZi9ssPBlXSwwccnNC7NqYC4ILISHZk9TwGetyY7e2GhGCnQBveGDMBODgz0xiHhc8whVDpS6F2Hp7L5cWPVTmIx0caC3lcUA89X/0KJIHh5NzfqXcipMCLsooEpKD5u4L67cMITHVf X-Bogosity: Ham, tests=bogofilter, spamicity=0.000006, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Lorenzo Stoakes writes: > On Thu, Apr 27, 2023 at 01:32:47PM -0400, Liam R. Howlett wrote: >> * Sven Schnelle [230427 02:53]: >> > "Liam R. Howlett" writes: >> > >> > > set_mempolicy_home_node() iterates over a list of VMAs and calls >> > > mbind_range() on each VMA, which also iterates over the singular list of >> > > the VMA passed in and potentially splits the VMA. Since the VMA >> > > iterator is not passed through, set_mempolicy_home_node() may now point >> > > to a stale node in the VMA tree. This can result in a UAF as reported >> > > by syzbot. >> > > >> > > Avoid the stale maple tree node by passing the VMA iterator through to >> > > the underlying call to split_vma(). >> > > >> > > mbind_range() is also overly complicated, since there are two calling >> > > functions and one already handles iterating over the VMAs. Simplify >> > > mbind_range() to only handle merging and splitting of the VMAs. >> > > >> > > Align the new loop in do_mbind() and existing loop in >> > > set_mempolicy_home_node() to use the reduced mbind_range() function. >> > > This allows for a single location of the range calculation and avoids >> > > constantly looking up the previous VMA (since this is a loop over the >> > > VMAs). >> > > >> > > Link: https://lore.kernel.org/linux-mm/000000000000c93feb05f87e24ad@google.com/ >> > > Reported-and-tested-by: syzbot+a7c1ec5b1d71ceaa5186@syzkaller.appspotmail.com >> > > Fixes: 66850be55e8e ("mm/mempolicy: use vma iterator & maple state instead of vma linked list") >> > > Cc: >> > > Signed-off-by: Liam R. Howlett >> > > --- >> > >> > This breaks the vma02 testcase from ltp on s390: >> > >> > ~ # ./vma02 >> > vma02 0 TINFO : pid = 617 addr = 0x3ff8f673000 >> > vma02 0 TINFO : start = 0x3ff8f673000, end = 0x3ff8f674000 >> > vma02 0 TINFO : start = 0x3ff8f674000, end = 0x3ff8f675000 >> > vma02 0 TINFO : start = 0x3ff8f675000, end = 0x3ff8f676000 >> > vma02 1 TFAIL : vma02.c:144: >1 unmerged VMAs. >> > Any thoughts? >> >> No thoughts that I should share. >> >> I will have to boot my s390 (vm) and have a look. >> >> Thanks for letting me know. >> >> Regards, >> Liam > > I tracked down what this (almost certainly) was + added fix in [1] as it > popped up as a 6.2.y stable bug. It doesn't seem arch-specific so you can > put that s390 down :) > > [1]:https://lore.kernel.org/all/db42467a692d78c654ec5c1953329401bd8a9c34.1682859234.git.lstoakes@gmail.com/ Thanks, just tested, and it solves the issue for me.