linux-hardening - Re: [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a4bc8ee2-8db9-5ce4-630b-ab0be6b1a890@suse.cz>
Date:   Fri, 2 Dec 2022 17:33:29 +0100
From:   Vlastimil Babka <vbabka@...e.cz>
To:     "Jason A. Donenfeld" <Jason@...c4.com>, akpm@...ux-foundation.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Cc:     "Liam R . Howlett" <Liam.Howlett@...cle.com>,
        Yu Zhao <yuzhao@...gle.com>,
        Catalin Marinas <catalin.marinas@....com>,
        David Hildenbrand <david@...hat.com>,
        David Howells <dhowells@...hat.com>,
        Davidlohr Bueso <dave@...olabs.net>,
        Matthew Wilcox <willy@...radead.org>,
        SeongJae Park <sj@...nel.org>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Will Deacon <will@...nel.org>
Subject: Re: [PATCH] mm: do not BUG_ON missing brk mapping, because userspace
 can unmap it

On 12/2/22 17:27, Jason A. Donenfeld wrote:
> The following program will trigger the BUG_ON that this patch removes,
> because the user can munmap() mm->brk:
> 
>   #include <sys/syscall.h>
>   #include <sys/mman.h>
>   #include <assert.h>
>   #include <unistd.h>
> 
>   static void *brk_now(void)
>   {
>     return (void *)syscall(SYS_brk, 0);
>   }
> 
>   static void brk_set(void *b)
>   {
>     assert(syscall(SYS_brk, b) != -1);
>   }
> 
>   int main(int argc, char *argv[])
>   {
>     void *b = brk_now();
>     brk_set(b + 4096);
>     assert(munmap(b - 4096, 4096 * 2) == 0);
>     brk_set(b);
>     return 0;
>   }
> 
> Compile that with musl, since glibc actually uses brk(), and then
> execute it, and it'll hit this splat:
> 
>   kernel BUG at mm/mmap.c:229!
>   invalid opcode: 0000 [#1] PREEMPT SMP
>   CPU: 12 PID: 1379 Comm: a.out Tainted: G S   U             6.1.0-rc7+ #419
>   RIP: 0010:__do_sys_brk+0x2fc/0x340
>   Code: 00 00 4c 89 ef e8 04 d3 fe ff eb 9a be 01 00 00 00 4c 89 ff e8 35 e0 fe ff e9 6e ff ff ff 4d 89 a7 20>
>   RSP: 0018:ffff888140bc7eb0 EFLAGS: 00010246
>   RAX: 0000000000000000 RBX: 00000000007e7000 RCX: ffff8881020fe000
>   RDX: ffff8881020fe001 RSI: ffff8881955c9b00 RDI: ffff8881955c9b08
>   RBP: 0000000000000000 R08: ffff8881955c9b00 R09: 00007ffc77844000
>   R10: 0000000000000000 R11: 0000000000000001 R12: 00000000007e8000
>   R13: 00000000007e8000 R14: 00000000007e7000 R15: ffff8881020fe000
>   FS:  0000000000604298(0000) GS:ffff88901f700000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: 0000000000603fe0 CR3: 000000015ba9a005 CR4: 0000000000770ee0
>   PKRU: 55555554
>   Call Trace:
>    <TASK>
>    do_syscall_64+0x2b/0x50
>    entry_SYSCALL_64_after_hwframe+0x46/0xb0
>   RIP: 0033:0x400678
>   Code: 10 4c 8d 41 08 4c 89 44 24 10 4c 8b 01 8b 4c 24 08 83 f9 2f 77 0a 4c 8d 4c 24 20 4c 01 c9 eb 05 48 8b>
>   RSP: 002b:00007ffc77863890 EFLAGS: 00000212 ORIG_RAX: 000000000000000c
>   RAX: ffffffffffffffda RBX: 000000000040031b RCX: 0000000000400678
>   RDX: 00000000004006a1 RSI: 00000000007e6000 RDI: 00000000007e7000
>   RBP: 00007ffc77863900 R08: 0000000000000000 R09: 00000000007e6000
>   R10: 00007ffc77863930 R11: 0000000000000212 R12: 00007ffc77863978
>   R13: 00007ffc77863988 R14: 0000000000000000 R15: 0000000000000000
>    </TASK>
> 
> Instead, just error out if the original mapping has been removed.
> 
> Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")

That's 6.1-rc1 so probably fast track to Linus as we don't need to introduce
such trivial local user DoS in 6.1, right?

> Cc: Liam R. Howlett <Liam.Howlett@...cle.com>
> Cc: Yu Zhao <yuzhao@...gle.com>
> Cc: Catalin Marinas <catalin.marinas@....com>
> Cc: David Hildenbrand <david@...hat.com>
> Cc: David Howells <dhowells@...hat.com>
> Cc: Davidlohr Bueso <dave@...olabs.net>
> Cc: Matthew Wilcox <willy@...radead.org>
> Cc: SeongJae Park <sj@...nel.org>
> Cc: Sven Schnelle <svens@...ux.ibm.com>
> Cc: Vlastimil Babka <vbabka@...e.cz>
> Cc: Will Deacon <will@...nel.org>
> Cc: Andrew Morton <akpm@...ux-foundation.org>
> Signed-off-by: Jason A. Donenfeld <Jason@...c4.com>

Acked-by: Vlastimil Babka <vbabka@...e.cz>

> ---
>  mm/mmap.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/mm/mmap.c b/mm/mmap.c
> index c3c5c1d6103d..f5a37fe9a19e 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
>  		/* Search one past newbrk */
>  		mas_set(&mas, newbrk);
>  		brkvma = mas_find(&mas, oldbrk);
> -		BUG_ON(brkvma == NULL);
> -		if (brkvma->vm_start >= oldbrk)
> +		if (!brkvma || brkvma->vm_start >= oldbrk)
>  			goto out; /* mapping intersects with an existing non-brk vma. */
>  		/*
>  		 * mm->brk must be protected by write mmap_lock.