linux-kernel - Re: [PATCH V2] mm: fix use-after free of page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 1 Aug 2022 15:08:17 +0200
From:   Michal Hocko <mhocko@...e.com>
To:     Charan Teja Kalla <quic_charante@...cinc.com>
Cc:     akpm@...ux-foundation.org, david@...hat.com,
        quic_pkondeti@...cinc.com, pasha.tatashin@...een.com,
        sjpark@...zon.de, sieberf@...zon.com, shakeelb@...gle.com,
        dhowells@...hat.com, willy@...radead.org, minchan@...nel.org,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH V2] mm: fix use-after free of page_ext after race with
 memory-offline

On Mon 01-08-22 18:31:45, Charan Teja Kalla wrote:
[...]
> >> The roll back operation in the online_page_ext(), where we free the
> >> allocated page_ext's, will not have the PAGE_EXT_INVALID flag thus
> >> WARN() may not work here. no?
> > Wouldn't ms->page_ext be NULL in that case?
> I don't think that ms->page_ext would be NULL here.
> online_page_ext():
>   (a) for (pfn = start; !fail && pfn < end; pfn += PAGES_PER_SECTION)
>      fail = init_section_page_ext():
> 	   ms->page_ext = (void *)base - page_ext_size * pfn;
> 
>   //If fail = -ERROR in the middle, roll back operation.
>   (b) for (pfn = start; pfn < end; pfn += PAGES_PER_SECTION)
>        __free_page_ext();
> 
>    Here (b) can be called on the sections without PAGE_EXT_INVALID with
> ms->page_ext != NULL.
> 
You are right. My sloppy code reading. A tiny comment would be nice.
Because this shouldn't really happen for normal calls.

-- 
Michal Hocko
SUSE Labs