linux-kernel - Re: [PATCH] mm: fix pgdat->kswap accessed concurrently

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <2B0D6AB9-736E-40EB-996F-C0B6200EE749@linux.dev>
Date:   Wed, 24 Aug 2022 15:03:50 +0800
From:   Muchun Song <muchun.song@...ux.dev>
To:     Kefeng Wang <wangkefeng.wang@...wei.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Linux MM <linux-mm@...ck.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm: fix pgdat->kswap accessed concurrently



> On Aug 23, 2022, at 22:47, Kefeng Wang <wangkefeng.wang@...wei.com> wrote:
> 
> 
> On 2022/8/23 9:07, Kefeng Wang wrote:
>> 
>> On 2022/8/21 4:59, Andrew Morton wrote:
>>> On Sat, 20 Aug 2022 15:33:04 +0800 Muchun Song <muchun.song@...ux.dev> wrote:
>>> 
>>>> 
>>>>> +    if (IS_ERR(t)) {
>>>>>         /* failure at boot is fatal */
>>>>>         BUG_ON(system_state < SYSTEM_RUNNING);
>>>>>         pr_err("Failed to start kswapd on node %d\n", nid);
>>>>> -        pgdat->kswapd = NULL;
>>>>> +        WRITE_ONCE(pgdat->kswapd, NULL);
>>>>> +    } else {
>>>>> +        WRITE_ONCE(pgdat->kswapd, t);
>>>>>     }
>>>>> }
>>>> IIUC, the race is like the followings:
>>>> 
>>>> CPU 0:                    CPU 1:
>>>> 
>>>> kswapd_run()
>>>>     pgdat->kswapd = kthread_run()
>>>>     if (IS_ERR(pgdat->kswapd))
>>>>                     kswapd_is_running
>>>>                         // load pgdat->kswapd and it is NOT NULL.
>>>>         pgdat->kswapd = NULL
>>>>                         task_is_running(pgdat->kswapd); // NULL pointer dereference
>>>> 
>>> But don't we still have a bug?  Sure, kswapd_is_running() will no
>>> longer deref a null pointer.  But it now runs kswapd_is_running()
>>> against a task which has exited - a use-after-free?
> 
> The UAF is caused by race between kswapd_stop() and kcompactd(), right?
> 
> so  kcompactd() should be stop before kswapd_stop() to avoid the above UAF.
> 
> $ git diff
> diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
> index fad6d1f2262a..2fd45ccbce45 100644
> --- a/mm/memory_hotplug.c
> +++ b/mm/memory_hotplug.c
> @@ -1940,8 +1940,8 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages,
> 
>         node_states_clear_node(node, &arg);
>         if (arg.status_change_nid >= 0) {
> -               kswapd_stop(node);
>                 kcompactd_stop(node);
> +               kswapd_stop(node);
>         }
> 
>         writeback_set_ratelimit();

The changes make sense to me. Again:

Reviewed-by: Muchun Song <songmuchun@...edance.com>

Thanks.

> 
>> we could add get/put_task_struct() to avoid the UAF， will update， thanks.
> 
> sorry, the task refcount won't fix anything.
> 
> 
>> .