linux-kernel - Re: mm: use-after-free in collapse_huge

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 2 Sep 2016 15:50:25 +0300
From:   Ebru Akagunduz <ebru.akagunduz@...il.com>
To:     "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc:     dvyukov@...gle.com, akpm@...ux-foundation.org, vbabka@...e.cz,
        mgorman@...hsingularity.net, hannes@...xchg.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        vegard.nossum@...cle.com, levinsasha928@...il.com,
        koct9i@...il.com, ryabinin.a.a@...il.com, gthelen@...gle.com,
        suleiman@...gle.com, hughd@...gle.com, rientjes@...gle.com,
        syzkaller@...glegroups.com, kcc@...gle.com, glider@...gle.com
Subject: Re: mm: use-after-free in collapse_huge_page

>  
> @@ -898,13 +899,13 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
>  		/* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */
>  		if (ret & VM_FAULT_RETRY) {
>  			down_read(&mm->mmap_sem);
> -			if (hugepage_vma_revalidate(mm, address)) {
> +			if (hugepage_vma_revalidate(mm, address, &vma)) {
>  				/* vma is no longer available, don't continue to swapin */
>  				trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);
>  				return false;
>  			}
>  			/* check if the pmd is still valid */
> -			if (mm_find_pmd(mm, address) != pmd)
> +			if (mm_find_pmd(mm, address) != pmd || vma != fe.vma)
>  				return false;
>  		}
>  		if (ret & VM_FAULT_ERROR) {
> @@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm,
>  static void collapse_huge_page(struct mm_struct *mm,
>  				   unsigned long address,
>  				   struct page **hpage,
> -				   struct vm_area_struct *vma,
>  				   int node, int referenced)
>  {
>  	pmd_t *pmd, _pmd;
> @@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>  	spinlock_t *pmd_ptl, *pte_ptl;
>  	int isolated = 0, result = 0;
>  	struct mem_cgroup *memcg;
> +	struct vm_area_struct *vma;
>  	unsigned long mmun_start;	/* For mmu_notifiers */
I could not realize, why we need to remove vma parameter and recreate it here?
>  	unsigned long mmun_end;		/* For mmu_notifiers */
>  	gfp_t gfp;
> @@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm,
>  	}
>  
>  	down_read(&mm->mmap_sem);
And without fe.vma check, this patch seems work for me.

Andrea, I've just sent a fix patch for leaking mapped ptes.

Kind regards,
Ebru