linux-kernel - Re: [PATCH v3] mm: hugetlb: fix UAF in hugetlb_handle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <11391501-c901-fd4d-5a05-50952aec011c@huawei.com>
Date:   Sat, 24 Sep 2022 11:34:39 +0800
From:   Liu Shixin <liushixin2@...wei.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
CC:     Liu Zixian <liuzixian4@...wei.com>,
        Mike Kravetz <mike.kravetz@...cle.com>,
        Muchun Song <songmuchun@...edance.com>,
        "Sidhartha Kumar" <sidhartha.kumar@...cle.com>,
        John Hubbard <jhubbard@...dia.com>,
        "David Hildenbrand" <david@...hat.com>,
        Kefeng Wang <wangkefeng.wang@...wei.com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] mm: hugetlb: fix UAF in hugetlb_handle_userfault



On 2022/9/24 8:05, Andrew Morton wrote:
> On Fri, 23 Sep 2022 12:21:13 +0800 Liu Shixin <liushixin2@...wei.com> wrote:
>
>> The vma_lock and hugetlb_fault_mutex are dropped before handling
>> userfault and reacquire them again after handle_userfault(), but
>> reacquire the vma_lock could lead to UAF[1,2] due to the following
>> race,
...
> Patch is against mm-unstable, which isn't appropriate for a backport. 
> Could you please something against current -linus (which will be more
> backportable), then I'll figure out the fallout on mm-unstable.
>
> Thanks.
> .
I resend v4 rebased on current -linus.
Link: https://lore.kernel.org/all/20220924034905.2694686-1-liushixin2@huawei.com/

Thanks,