linux-kernel - Re: [PATCH] fork: defer linking file vma until vma is fully initialized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240410132157.b0e54f59b066f2c1d322d425@linux-foundation.org>
Date: Wed, 10 Apr 2024 13:21:57 -0700
From: Andrew Morton <akpm@...ux-foundation.org>
To: Miaohe Lin <linmiaohe@...wei.com>
Cc: <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>,
 <brauner@...nel.org>, <oleg@...hat.com>, <tandersen@...flix.com>,
 <mjguzik@...il.com>, <willy@...radead.org>, <kent.overstreet@...ux.dev>,
 <zhangpeng.00@...edance.com>, <hca@...ux.ibm.com>,
 <mike.kravetz@...cle.com>, <muchun.song@...ux.dev>, <thorvald@...gle.com>,
 <Liam.Howlett@...cle.com>, <jane.chu@...cle.com>
Subject: Re: [PATCH] fork: defer linking file vma until vma is fully
 initialized

On Wed, 10 Apr 2024 17:14:41 +0800 Miaohe Lin <linmiaohe@...wei.com> wrote:

> Thorvald reported a WARNING [1]. And the root cause is below race:
> 
>  CPU 1					CPU 2
>  fork					hugetlbfs_fallocate
>   dup_mmap				 hugetlbfs_punch_hole
>    i_mmap_lock_write(mapping);
>    vma_interval_tree_insert_after -- Child vma is visible through i_mmap tree.
>    i_mmap_unlock_write(mapping);
>    hugetlb_dup_vma_private -- Clear vma_lock outside i_mmap_rwsem!
> 					 i_mmap_lock_write(mapping);
>    					 hugetlb_vmdelete_list
> 					  vma_interval_tree_foreach
> 					   hugetlb_vma_trylock_write -- Vma_lock is cleared.
>    tmp->vm_ops->open -- Alloc new vma_lock outside i_mmap_rwsem!
> 					   hugetlb_vma_unlock_write -- Vma_lock is assigned!!!
> 					 i_mmap_unlock_write(mapping);
> 
> hugetlb_dup_vma_private() and hugetlb_vm_op_open() are called outside
> i_mmap_rwsem lock while vma lock can be used in the same time. Fix this
> by deferring linking file vma until vma is fully initialized. Those vmas
> should be initialized first before they can be used.

Cool.  I queued this in mm-hotfixes (for 6.8-rcX) and I added a cc:stable.