[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Zv8HRA5mnhVevBN_@x1n>
Date: Thu, 3 Oct 2024 17:06:12 -0400
From: Peter Xu <peterx@...hat.com>
To: Matthew Wilcox <willy@...radead.org>
Cc: manas18244@...td.ac.in, Andrew Morton <akpm@...ux-foundation.org>,
Shuah Khan <skhan@...uxfoundation.org>,
Anup Sharma <anupnewsmail@...il.com>, linux-mm@...ck.org,
linux-kernel@...r.kernel.org,
syzbot+093d096417e7038a689b@...kaller.appspotmail.com
Subject: Re: [PATCH] Fixes: null pointer dereference in pfnmap_lockdep_assert
Matthew,
On Thu, Oct 03, 2024 at 09:31:17PM +0100, Matthew Wilcox wrote:
> On Thu, Oct 03, 2024 at 09:31:06PM +0530, Manas via B4 Relay wrote:
> > From: Manas <manas18244@...td.ac.in>
> >
> > syzbot has pointed to a possible null pointer dereference in
> > pfnmap_lockdep_assert. vm_file member of vm_area_struct is being
> > dereferenced without any checks.
> >
> > This fix returns if vm_file member in vm_area_struct is NULL.
>
> This seems like the wrong fix. It's mmap'ing a file, so vm_file should
> not be NULL. Or have I forgotten something very important about how the
> MM works?
If I read the stack right, the crash was before mmap() of the new vma
happens, instead it's during unmap() of one existing vma which existed and
overlapped with the new vma's mapping range:
follow_phys arch/x86/mm/pat/memtype.c:956 [inline]
get_pat_info+0x182/0x3f0 arch/x86/mm/pat/memtype.c:988
untrack_pfn+0x327/0x640 arch/x86/mm/pat/memtype.c:1101
unmap_single_vma+0x1f6/0x2b0 mm/memory.c:1834
unmap_vmas+0x3cc/0x5f0 mm/memory.c:1900
unmap_region+0x214/0x380 mm/vma.c:354 <--------------- here
mmap_region+0x22f9/0x2990 mm/mmap.c:1573
do_mmap+0x8f0/0x1000 mm/mmap.c:496
vm_mmap_pgoff+0x1dd/0x3d0 mm/util.c:588
ksys_mmap_pgoff+0x4eb/0x720 mm/mmap.c:542
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
It looks like the vma that was overwritten by the new file vma mapping
could be a VM_PFNMAP vma (I'm guessing vvar or something similar..), that's
where untrack_pfn() got kicked off. In this case, the vma being
overwritten and to be unmapped can have ->vm_file==NULL (while ->vm_ops
non-NULL; /me looking at __install_special_mapping()).
Thanks,
--
Peter Xu
Powered by blists - more mailing lists