linux-kernel - Re: MREMAP_FIXED unmaps dest on error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 Apr 2023 13:58:04 +0200
From:   David Hildenbrand <david@...hat.com>
To:     stsp <stsp2@...dex.ru>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Cc:     linux-mm@...ck.org,
        Jakub Matěna <matenajakub@...il.com>,
        Hugh Dickins <hughd@...gle.com>,
        Vlastimil Babka <vbabka@...e.cz>,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>
Subject: Re: MREMAP_FIXED unmaps dest on error

On 30.03.23 17:48, stsp wrote:
> Hello.
> 
> The attached test-case demonstrates a
> bug in mremap(). If MREMAP_FIXED is used
> over an existing mapping and mremap() fails,
> destination area gets unmapped.
> AFAIK the failed syscall should have no
> observable effects.

I remember that holds for various mapping-related syscalls: if something 
goes wrong, the end result is not guaranteed to be what we had before 
the syscall.

For example, if you use mmap(MAP_FIXED) to replace part of an exiting 
mapping, we first munmap what's there and then try to mmap the new 
mapping. If something goes wrong while doing that, we cannot simple undo 
what we already did.

Long story short: the semantics of these syscalls has never been to 
leave the system in the state as it was before in case anything goes wrong.

As another example, if you do an mprotect() that covers multiple VMAS, 
and there is an issue with the last VMA, all but the last VMA will have 
their permissions changed.

-- 
Thanks,

David / dhildenb