Date:   Sat, 8 Jul 2023 01:46:33 +0900
From:   Hyeonggon Yoo <42.hyeyoo@...il.com>
To:     David Howells <dhowells@...hat.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Matthew Wilcox <willy@...radead.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jeff Layton <jlayton@...nel.org>,
        Christoph Hellwig <hch@...radead.org>,
        linux-afs@...ts.infradead.org, linux-nfs@...r.kernel.org,
        linux-cifs@...r.kernel.org, ceph-devel@...r.kernel.org,
        v9fs-developer@...ts.sourceforge.net, linux-erofs@...ts.ozlabs.org,
        linux-ext4@...r.kernel.org, linux-cachefs@...hat.com,
        linux-fsdevel@...r.kernel.org,
        Rohith Surabattula <rohiths.msft@...il.com>,
        Steve French <sfrench@...ba.org>,
        Shyam Prasad N <nspmangalore@...il.com>,
        Dave Wysochanski <dwysocha@...hat.com>,
        Dominique Martinet <asmadeus@...ewreck.org>,
        Ilya Dryomov <idryomov@...il.com>, linux-mm@...ck.org
Subject: Re: [BUG mm-unstable] BUG: KASAN: use-after-free in shrink_folio_list+0x9f4/0x1ae0

On Sat, Jul 8, 2023 at 1:39 AM Hyeonggon Yoo <42.hyeyoo@...il.com> wrote:
>
> On Wed, Jun 28, 2023 at 11:48:52AM +0100, David Howells wrote:
> > Fscache has an optimisation by which reads from the cache are skipped until
> > we know that (a) there's data there to be read and (b) that data isn't
> > entirely covered by pages resident in the netfs pagecache.  This is done
> > with two flags manipulated by fscache_note_page_release():
> >
> >       if (...
> >           test_bit(FSCACHE_COOKIE_HAVE_DATA, &cookie->flags) &&
> >           test_bit(FSCACHE_COOKIE_NO_DATA_TO_READ, &cookie->flags))
> >               clear_bit(FSCACHE_COOKIE_NO_DATA_TO_READ, &cookie->flags);
> >
> > where the NO_DATA_TO_READ flag causes cachefiles_prepare_read() to indicate
> > that netfslib should download from the server or clear the page instead.
> >
> > The fscache_note_page_release() function is intended to be called from
> > ->releasepage() - but that only gets called if PG_private or PG_private_2
> > is set - and currently the former is at the discretion of the network
> > filesystem and the latter is only set whilst a page is being written to the
> > cache, so sometimes we miss clearing the optimisation.
> >
> > Fix this by following Willy's suggestion[1] and adding an address_space
> > flag, AS_RELEASE_ALWAYS, that causes filemap_release_folio() to always call
> > ->release_folio() if it's set, even if PG_private or PG_private_2 aren't
> > set.
> >
> > Note that this would require folio_test_private() and page_has_private() to
> > become more complicated.  To avoid that, in the places[*] where these are
> > used to conditionalise calls to filemap_release_folio() and
> > try_to_release_page(), the tests are removed the those functions just
> > jumped to unconditionally and the test is performed there.
> >
> > [*] There are some exceptions in vmscan.c where the check guards more than
> > just a call to the releaser.  I've added a function, folio_needs_release()
> > to wrap all the checks for that.
> >
> > AS_RELEASE_ALWAYS should be set if a non-NULL cookie is obtained from
> > fscache and cleared in ->evict_inode() before truncate_inode_pages_final()
> > is called.
> >
> > Additionally, the FSCACHE_COOKIE_NO_DATA_TO_READ flag needs to be cleared
> > and the optimisation cancelled if a cachefiles object already contains data
> > when we open it.
> >
> > Fixes: 1f67e6d0b188 ("fscache: Provide a function to note the release of a page")
> > Fixes: 047487c947e8 ("cachefiles: Implement the I/O routines")
> > Reported-by: Rohith Surabattula <rohiths.msft@...il.com>
> > Suggested-by: Matthew Wilcox <willy@...radead.org>
> > Signed-off-by: David Howells <dhowells@...hat.com>
>
> Hi David,
>
> I was bisecting a use-after-free BUG on the latest mm-unstable,
> where HEAD is 347e208de0e4 ("rmap: pass the folio to __page_check_anon_rmap()").
>
> According to my bisection, this is the first bad commit.
> Use-After-Free is triggered on reclamation path when swap is enabled.

This was originally occurred during kernel compilation but
can easily be reproduced via:

stress-ng --bigheap $(nproc)

> (and couldn't trigger without swap enabled)
>
> the config, KASAN splat, bisect log are attached.
> hope this isn't too late :(
>
> > cc: Matthew Wilcox <willy@...radead.org>
> > cc: Linus Torvalds <torvalds@...ux-foundation.org>
> > cc: Steve French <sfrench@...ba.org>
> > cc: Shyam Prasad N <nspmangalore@...il.com>
> > cc: Rohith Surabattula <rohiths.msft@...il.com>
> > cc: Dave Wysochanski <dwysocha@...hat.com>
> > cc: Dominique Martinet <asmadeus@...ewreck.org>
> > cc: Ilya Dryomov <idryomov@...il.com>
> > cc: linux-cachefs@...hat.com
> > cc: linux-cifs@...r.kernel.org
> > cc: linux-afs@...ts.infradead.org
> > cc: v9fs-developer@...ts.sourceforge.net
> > cc: ceph-devel@...r.kernel.org
> > cc: linux-nfs@...r.kernel.org
> > cc: linux-fsdevel@...r.kernel.org
> > cc: linux-mm@...ck.org
> > ---
> >
> > Notes:
> >     ver #7)
> >      - Make NFS set AS_RELEASE_ALWAYS.
> >
> >     ver #4)
> >      - Split out merging of folio_has_private()/filemap_release_folio() call
> >        pairs into a preceding patch.
> >      - Don't need to clear AS_RELEASE_ALWAYS in ->evict_inode().
> >
> >     ver #3)
> >      - Fixed mapping_clear_release_always() to use clear_bit() not set_bit().
> >      - Moved a '&&' to the correct line.
> >
> >     ver #2)
> >      - Rewrote entirely according to Willy's suggestion[1].
> >
> >  fs/9p/cache.c           |  2 ++
> >  fs/afs/internal.h       |  2 ++
> >  fs/cachefiles/namei.c   |  2 ++
> >  fs/ceph/cache.c         |  2 ++
> >  fs/nfs/fscache.c        |  3 +++
> >  fs/smb/client/fscache.c |  2 ++
> >  include/linux/pagemap.h | 16 ++++++++++++++++
> >  mm/internal.h           |  5 ++++-
> >  8 files changed, 33 insertions(+), 1 deletion(-)

Powered by blists - more mailing lists