linux-kernel - Re: [PATCH 01/12] Revert "mm: pgtable: make ptlock be freed by RCU"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20241215223542.2b8e45a7d68f6ebc71b5ce3a@linux-foundation.org>
Date: Sun, 15 Dec 2024 22:35:42 -0800
From: Andrew Morton <akpm@...ux-foundation.org>
To: Qi Zheng <zhengqi.arch@...edance.com>
Cc: Yu Zhao <yuzhao@...gle.com>, peterz@...radead.org, tglx@...utronix.de,
 david@...hat.com, jannh@...gle.com, hughd@...gle.com, willy@...radead.org,
 muchun.song@...ux.dev, vbabka@...nel.org, lorenzo.stoakes@...cle.com,
 rientjes@...gle.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 01/12] Revert "mm: pgtable: make ptlock be freed by RCU"

On Mon, 16 Dec 2024 14:15:35 +0800 Qi Zheng <zhengqi.arch@...edance.com> wrote:

> Hi Andrew,
> 
> On 2024/12/16 14:10, Andrew Morton wrote:
> > On Sun, 15 Dec 2024 14:29:38 +0800 Qi Zheng <zhengqi.arch@...edance.com> wrote:
> > 
> >>>
> >>> Acked-by: Yu Zhao <yuzhao@...gle.com>
> >>
> >> Thanks! Once the review of this patch series is completed, we can simply
> >> drop "mm: pgtable: make ptlock be freed by RCU" from mm tree.
> > 
> > Can we drop it now and does the remainder of the series "synchronously
> > scan and reclaim empty user PTE pages v4" remain valid and useful?
> 
> The "mm: pgtable: make ptlock be freed by RCU" fixes the UAF issue [1]
> reported by syzbot. If it is dropped now and this patch series is not
> merged, the UAF issue will reappear.
> 
> [1]. 
> https://lore.kernel.org/lkml/67548279.050a0220.a30f1.015b.GAE@google.com/

OK, so as I understand it,

- the series "synchronously scan and reclaim empty user PTE pages v4"
  exposes a use-after-free bug, and fixes that bug with the patch "mm:
  pgtable: make ptlock be freed by RCU".

- The series "move pagetable_*_dtor() to __tlb_remove_table()" fixes
  that bug in a more desirable way.

- So when the series "move pagetable_*_dtor() to
  __tlb_remove_table()" is merged into mm-unstable, I drop the patch
  "mm: pgtable: make ptlock be freed by RCU".

Correct?