linux-kernel - Re: [RFC][PATCH] mm: Split locks in remap_file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez1Bd7dWmXpMS2=f6gHoSxhySv2v3m5_BvucMNtC3AZeew@mail.gmail.com>
Date: Fri, 18 Oct 2024 17:05:04 +0200
From: Jann Horn <jannh@...gle.com>
To: Roberto Sassu <roberto.sassu@...weicloud.com>
Cc: akpm@...ux-foundation.org, Liam.Howlett@...cle.com, 
	lorenzo.stoakes@...cle.com, vbabka@...e.cz, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, ebpqwerty472123@...il.com, paul@...l-moore.com, 
	zohar@...ux.ibm.com, dmitry.kasatkin@...il.com, eric.snowberg@...cle.com, 
	jmorris@...ei.org, serge@...lyn.com, linux-integrity@...r.kernel.org, 
	linux-security-module@...r.kernel.org, bpf@...r.kernel.org, 
	linux-fsdevel@...r.kernel.org, 
	"Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>, stable@...r.kernel.org, 
	syzbot+91ae49e1c1a2634d20c0@...kaller.appspotmail.com, 
	Roberto Sassu <roberto.sassu@...wei.com>
Subject: Re: [RFC][PATCH] mm: Split locks in remap_file_pages()

On Fri, Oct 18, 2024 at 4:48 PM Roberto Sassu
<roberto.sassu@...weicloud.com> wrote:
> Commit ea7e2d5e49c0 ("mm: call the security_mmap_file() LSM hook in
> remap_file_pages()") fixed a security issue, it added an LSM check when
> trying to remap file pages, so that LSMs have the opportunity to evaluate
> such action like for other memory operations such as mmap() and mprotect().
>
> However, that commit called security_mmap_file() inside the mmap_lock lock,
> while the other calls do it before taking the lock, after commit
> 8b3ec6814c83 ("take security_mmap_file() outside of ->mmap_sem").
>
> This caused lock inversion issue with IMA which was taking the mmap_lock
> and i_mutex lock in the opposite way when the remap_file_pages() system
> call was called.
>
> Solve the issue by splitting the critical region in remap_file_pages() in
> two regions: the first takes a read lock of mmap_lock and retrieves the VMA
> and the file associated, and calculate the 'prot' and 'flags' variable; the
> second takes a write lock on mmap_lock, checks that the VMA flags and the
> VMA file descriptor are the same as the ones obtained in the first critical
> region (otherwise the system call fails), and calls do_mmap().
>
> In between, after releasing the read lock and taking the write lock, call
> security_mmap_file(), and solve the lock inversion issue.
>
> Cc: stable@...r.kernel.org
> Fixes: ea7e2d5e49c0 ("mm: call the security_mmap_file() LSM hook in remap_file_pages()")
> Reported-by: syzbot+91ae49e1c1a2634d20c0@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/linux-security-module/66f7b10e.050a0220.46d20.0036.GAE@google.com/
> Reviewed-by: Roberto Sassu <roberto.sassu@...wei.com> (Calculate prot and flags earlier)
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>

Reviewed-by: Jann Horn <jannh@...gle.com>