linux-kernel - Re: [RFC PATCH v3 2/6] [PATCH 2/6] mm: add merging after mremap resize

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 20 May 2022 16:48:08 +0200
From:   Jakub Matěna <matenajakub@...il.com>
To:     "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     linux-mm@...ck.org, patches@...ts.linux.dev,
        linux-kernel@...r.kernel.org, Vlastimil Babka <vbabka@...e.cz>,
        mhocko@...nel.org, mgorman@...hsingularity.net,
        willy@...radead.org, Liam Howlett <liam.howlett@...cle.com>,
        Hugh Dickins <hughd@...gle.com>, riel@...riel.com,
        rostedt@...dmis.org, peterz@...radead.org, david@...hat.com
Subject: Re: [RFC PATCH v3 2/6] [PATCH 2/6] mm: add merging after mremap resize

On Fri, May 20, 2022 at 3:39 PM Kirill A. Shutemov <kirill@...temov.name> wrote:
>
> On Mon, May 16, 2022 at 02:54:01PM +0200, Jakub Matěna wrote:
> > When mremap call results in expansion, it might be possible to merge the
> > VMA with the next VMA which might become adjacent. This patch adds
> > vma_merge call after the expansion is done to try and merge.
> >
> > Signed-off-by: Jakub Matěna <matenajakub@...il.com>
> > ---
> >  mm/mremap.c | 7 +++++--
> >  1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/mm/mremap.c b/mm/mremap.c
> > index 303d3290b938..75cda854ec58 100644
> > --- a/mm/mremap.c
> > +++ b/mm/mremap.c
> > @@ -9,6 +9,7 @@
> >   */
> >
> >  #include <linux/mm.h>
> > +#include <linux/mm_inline.h>
> >  #include <linux/hugetlb.h>
> >  #include <linux/shm.h>
> >  #include <linux/ksm.h>
> > @@ -1022,8 +1023,10 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
> >                               }
> >                       }
> >
> > -                     if (vma_adjust(vma, vma->vm_start, addr + new_len,
> > -                                    vma->vm_pgoff, NULL)) {
> > +                     if (!vma_merge(mm, vma, addr + old_len, addr + new_len,
> > +                                     vma->vm_flags, vma->anon_vma, vma->vm_file,
> > +                                     vma->vm_pgoff + (old_len >> PAGE_SHIFT), vma_policy(vma),
> > +                                     vma->vm_userfaultfd_ctx, anon_vma_name(vma))) {
>
> Hm. Don't you need to update 'vma' with result of vma_merge()?
>
> 'vma' is used below the point and IIUC it can be use-after-free.
>

Actually, this merge call is always either case 1 or 2 as they are
defined in the vma_merge(). So, either way the 'vma' can absorb its
neighbors but never gets absorbed itself.
But you are right and I will add the update, because otherwise it
would depend on the vma_merge() implementation, which could possibly
change in the future and cause a bug.

> --
>  Kirill A. Shutemov