linux-kernel - Re: [PATCH 01/12] Revert "mm: pgtable: make ptlock be freed by RCU"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6584dc86-dadf-4a30-9da0-15eef253ce22@bytedance.com>
Date: Mon, 16 Dec 2024 14:39:48 +0800
From: Qi Zheng <zhengqi.arch@...edance.com>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Yu Zhao <yuzhao@...gle.com>, peterz@...radead.org, tglx@...utronix.de,
 david@...hat.com, jannh@...gle.com, hughd@...gle.com, willy@...radead.org,
 muchun.song@...ux.dev, vbabka@...nel.org, lorenzo.stoakes@...cle.com,
 rientjes@...gle.com, linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 01/12] Revert "mm: pgtable: make ptlock be freed by RCU"



On 2024/12/16 14:35, Andrew Morton wrote:
> On Mon, 16 Dec 2024 14:15:35 +0800 Qi Zheng <zhengqi.arch@...edance.com> wrote:
> 
>> Hi Andrew,
>>
>> On 2024/12/16 14:10, Andrew Morton wrote:
>>> On Sun, 15 Dec 2024 14:29:38 +0800 Qi Zheng <zhengqi.arch@...edance.com> wrote:
>>>
>>>>>
>>>>> Acked-by: Yu Zhao <yuzhao@...gle.com>
>>>>
>>>> Thanks! Once the review of this patch series is completed, we can simply
>>>> drop "mm: pgtable: make ptlock be freed by RCU" from mm tree.
>>>
>>> Can we drop it now and does the remainder of the series "synchronously
>>> scan and reclaim empty user PTE pages v4" remain valid and useful?
>>
>> The "mm: pgtable: make ptlock be freed by RCU" fixes the UAF issue [1]
>> reported by syzbot. If it is dropped now and this patch series is not
>> merged, the UAF issue will reappear.
>>
>> [1].
>> https://lore.kernel.org/lkml/67548279.050a0220.a30f1.015b.GAE@google.com/
> 
> OK, so as I understand it,
> 
> - the series "synchronously scan and reclaim empty user PTE pages v4"
>    exposes a use-after-free bug, and fixes that bug with the patch "mm:
>    pgtable: make ptlock be freed by RCU".
> 
> - The series "move pagetable_*_dtor() to __tlb_remove_table()" fixes
>    that bug in a more desirable way.
> 
> - So when the series "move pagetable_*_dtor() to
>    __tlb_remove_table()" is merged into mm-unstable, I drop the patch
>    "mm: pgtable: make ptlock be freed by RCU".
> 
> Correct?

Right!