linux-kernel - Re: [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in kernfs_drain_open

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 27 Jan 2024 16:02:40 -0800
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: Neel Natu <neelnatu@...gle.com>
Cc: Tejun Heo <tj@...nel.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kernfs: fix false-positive WARN(nr_mmapped) in
 kernfs_drain_open_files

On Sat, Jan 27, 2024 at 03:46:36PM -0800, Neel Natu wrote:
> Prior to this change 'on->nr_mmapped' tracked the total number of
> mmaps across all of its associated open files via kernfs_fop_mmap().
> Thus if the file descriptor associated with a kernfs_open_file was
> mmapped 10 times then we would have: 'of->mmapped = true' and
> 'of_on(of)->nr_mmapped = 10'.
> 
> The problem is that closing or draining a 'of->mmapped' file would
> only decrement one from the 'of_on(of)->nr_mmapped' counter.
> 
> For e.g. we have this from kernfs_unlink_open_file():
>         if (of->mmapped)
>                 on->nr_mmapped--;
> 
> The WARN_ON_ONCE(on->nr_mmapped) in kernfs_drain_open_files() is
> easy to reproduce by:
> 1. opening a (mmap-able) kernfs file.
> 2. mmap-ing that file more than once (mapping just once masks the issue).
> 3. trigger a drain of that kernfs file.
> 
> Modulo out-of-tree patches I was able to trigger this reliably by
> identifying pci device nodes in sysfs that have resource regions
> that are mmap-able and that don't have any driver attached to them
> (steps 1 and 2). For step 3 we can "echo 1 > remove" to trigger a
> kernfs_drain.
> 
> Signed-off-by: Neel Natu <neelnatu@...gle.com>
> ---
>  fs/kernfs/file.c | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
> index ffa4565c275a..e9df2f87072c 100644
> --- a/fs/kernfs/file.c
> +++ b/fs/kernfs/file.c
> @@ -483,9 +483,11 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma)
>  		goto out_put;
>  
>  	rc = 0;
> -	of->mmapped = true;
> -	of_on(of)->nr_mmapped++;
> -	of->vm_ops = vma->vm_ops;
> +	if (!of->mmapped) {
> +		of->mmapped = true;
> +		of_on(of)->nr_mmapped++;
> +		of->vm_ops = vma->vm_ops;
> +	}
>  	vma->vm_ops = &kernfs_vm_ops;
>  out_put:
>  	kernfs_put_active(of->kn);

What commit id does this fix?

thanks,

greg k-h