linux-kernel - Re: [PATCH] mm: Downgrade mmap_sem before locking or populating on mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20121216201621.GG4939@ZenIV.linux.org.uk>
Date:	Sun, 16 Dec 2012 20:16:21 +0000
From:	Al Viro <viro@...IV.linux.org.uk>
To:	Andy Lutomirski <luto@...capital.net>
Cc:	linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Ingo Molnar <mingo@...nel.org>,
	Michel Lespinasse <walken@...gle.com>,
	Hugh Dickins <hughd@...gle.com>, J??rn Engel <joern@...fs.org>
Subject: Re: [PATCH] mm: Downgrade mmap_sem before locking or populating on
 mmap

On Sun, Dec 16, 2012 at 05:04:03PM +0000, Al Viro wrote:

> That's just from a couple of days of RTFS.  The locking in there is far too
> convoluted as it is; worse, it's not localized code-wise, so rechecking
> correctness is going to remain a big time-sink ;-/
> 
> Making it *more* complex doesn't look like a good idea, TBH...

... and another fun place: kvm_setup_async_pf() grabs a _passive_ reference
to current->mm (->mm_count, not ->mm_users), sticks it into work->mm and
schedules execution of async_pf_execute().  Which does use_mm() (still no
active refs acquired), grabs work->mm->mmap_sem shared and proceeds to call
get_user_pages().  What's going to happen if somebody does kill -9 to
the process that had started that?

get_user_pages() in parallel with exit_mmap() is a Bad Thing(tm) and I don't
see anything on the exit path that would've waited for that work to finish.
I might've missed something here, but...  Note that aio (another place
playing with use_mm(), also without an active ref) has an explicit hook
for mmput() to call before proceeding to exit_mmap(); I don't see anything
similar here.

Not that aio.c approach had been all that safe - get_task_mm() will refuse
to pick use_mm'ed one, but there are places open-coding it without the
check for PF_KTHREAD.  Few of them, fortunately, but...
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/