linux-kernel - Re: [syzbot] [mm?] KCSAN: data-race in mprotect_fixup / try_to_migrate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG48ez0raDom84xznCGkmtJ+afz74zzgdhUSMZD41QJPCBkP4g@mail.gmail.com>
Date: Wed, 5 Feb 2025 16:52:22 +0100
From: Jann Horn <jannh@...gle.com>
To: "Liam R. Howlett" <Liam.Howlett@...cle.com>, Jann Horn <jannh@...gle.com>, 
	syzbot <syzbot+c2e5712cbb14c95d4847@...kaller.appspotmail.com>, 
	akpm@...ux-foundation.org, linux-kernel@...r.kernel.org, linux-mm@...ck.org, 
	lorenzo.stoakes@...cle.com, syzkaller-bugs@...glegroups.com, vbabka@...e.cz
Subject: Re: [syzbot] [mm?] KCSAN: data-race in mprotect_fixup / try_to_migrate_one

On Wed, Feb 5, 2025 at 4:47 PM Liam R. Howlett <Liam.Howlett@...cle.com> wrote:
> * Jann Horn <jannh@...gle.com> [250205 10:00]:
> > The comments in the VMA flags code incorrectly assume that no
> > concurrency is possible here; and I think the comment in
> > mprotect_fixup() about protection by the mmap_lock has also been kinda
> > wrong since the beginning of git history.
> >
> > The VM_LOCKED check in the migration code was added by Hugh in commit
> > b74355078b655, but that's just one example syzbot stumbled over; we
> > have similar racy vm_flags reads through the rmap on other paths like:
> >
> > unmap_mapping_range_tree -> unmap_mapping_range_vma ->
> > zap_page_range_single -> unmap_single_vma -> unmap_page_range -> ...
> > -> zap_pte_range -> zap_present_ptes -> vm_normal_page
>
> I think we need a list of vm_area_struct parts that are OK to access
> without the read/write/vma lock.  It seems flags is not one of those as
> it could be racy.

We do have this big table in these nice docs that Lorenzo spent quite
some effort on:
https://kernel.org/doc/html/latest/mm/process_addrs.html#vma-fields

Though that does not currently call out this possible concurrency of vm_flags.