* [PATCH] Fix mm->owner point to a tsk that has been free
@ 2018-12-18 5:24 ` gchen.guomin
0 siblings, 0 replies; 5+ messages in thread
From: gchen.guomin @ 2018-12-18 5:24 UTC (permalink / raw)
To: Michael S. Tsirkin, Jason Wang, Christoph Hellwig, Andrew Morton,
Luis R. Rodriguez, guominchen
Cc: guomin chen, Eric W. Biederman, Dominik Brodowski, Arnd Bergmann,
linux-kernel, linux-mm
From: guomin chen <gchen.guomin@gmail.com>
When mm->owner is modified by exit_mm, if the new owner directly calls
unuse_mm to exit, it will cause Use-After-Free. Due to the unuse_mm()
directly sets tsk->mm=NULL.
Under normal circumstances,When do_exit exits, mm->owner will
be updated on exit_mm(). but when the kernel process calls
unuse_mm() and then exits,mm->owner cannot be updated. And it
will point to a task that has been released.
The current issue flow is as follows: (Process A,B,C use the same mm)
Process C Process A Process B
qemu-system-x86_64: kernel:vhost_net kernel: vhost_net
open /dev/vhost-net
VHOST_SET_OWNER create kthread vhost-%d create kthread vhost-%d
network init use_mm() use_mm()
... ...
Abnormal exited
...
do_exit
exit_mm()
update mm->owner to A
exit_files()
close_files()
kthread_should_stop() unuse_mm()
Stop Process A tsk->mm=NULL
do_exit()
can't update owner
A exit completed vhost-%d rcv first package
vhost-%d build rcv buffer for vq
page fault
access mm & mm->owner
NOW,mm->owner still pointer A
kernel UAF
stop Process B
Although I am having this issue on vhost_net,But it affects all users of
unuse_mm.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-kernel@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: guomin chen <gchen.guomin@gmail.com>
---
mm/mmu_context.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/mmu_context.c b/mm/mmu_context.c
index 3e612ae..9eb81aa 100644
--- a/mm/mmu_context.c
+++ b/mm/mmu_context.c
@@ -60,5 +60,6 @@ void unuse_mm(struct mm_struct *mm)
/* active_mm is still 'mm' */
enter_lazy_tlb(mm, tsk);
task_unlock(tsk);
+ mm_update_next_owner(mm);
}
EXPORT_SYMBOL_GPL(unuse_mm);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [PATCH] Fix mm->owner point to a tsk that has been free
@ 2018-12-18 5:24 ` gchen.guomin
0 siblings, 0 replies; 5+ messages in thread
From: gchen.guomin @ 2018-12-18 5:24 UTC (permalink / raw)
To: Michael S. Tsirkin, Jason Wang, Christoph Hellwig, Andrew Morton,
Luis R. Rodriguez, guominchen
Cc: guomin chen, Eric W. Biederman, Dominik Brodowski, Arnd Bergmann,
linux-kernel, linux-mm
From: guomin chen <gchen.guomin@gmail.com>
When mm->owner is modified by exit_mm, if the new owner directly calls
unuse_mm to exit, it will cause Use-After-Free. Due to the unuse_mm()
directly sets tsk->mm=NULL.
Under normal circumstances,When do_exit exits, mm->owner will
be updated on exit_mm(). but when the kernel process calls
unuse_mm() and then exits,mm->owner cannot be updated. And it
will point to a task that has been released.
The current issue flow is as follows: (Process A,B,C use the same mm)
Process C Process A Process B
qemu-system-x86_64: kernel:vhost_net kernel: vhost_net
open /dev/vhost-net
VHOST_SET_OWNER create kthread vhost-%d create kthread vhost-%d
network init use_mm() use_mm()
... ...
Abnormal exited
...
do_exit
exit_mm()
update mm->owner to A
exit_files()
close_files()
kthread_should_stop() unuse_mm()
Stop Process A tsk->mm=NULL
do_exit()
can't update owner
A exit completed vhost-%d rcv first package
vhost-%d build rcv buffer for vq
page fault
access mm & mm->owner
NOW,mm->owner still pointer A
kernel UAF
stop Process B
Although I am having this issue on vhost_net,But it affects all users of
unuse_mm.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "Luis R. Rodriguez" <mcgrof@kernel.org>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-kernel@vger.kernel.org
Cc: linux-mm@kvack.org
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: guomin chen <gchen.guomin@gmail.com>
---
mm/mmu_context.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/mm/mmu_context.c b/mm/mmu_context.c
index 3e612ae..9eb81aa 100644
--- a/mm/mmu_context.c
+++ b/mm/mmu_context.c
@@ -60,5 +60,6 @@ void unuse_mm(struct mm_struct *mm)
/* active_mm is still 'mm' */
enter_lazy_tlb(mm, tsk);
task_unlock(tsk);
+ mm_update_next_owner(mm);
}
EXPORT_SYMBOL_GPL(unuse_mm);
--
1.8.3.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] Fix mm->owner point to a tsk that has been free
2018-12-18 5:24 ` gchen.guomin
(?)
@ 2018-12-18 9:52 ` Michal Hocko
2018-12-18 16:21 ` gchen chen
-1 siblings, 1 reply; 5+ messages in thread
From: Michal Hocko @ 2018-12-18 9:52 UTC (permalink / raw)
To: gchen.guomin
Cc: Michael S. Tsirkin, Jason Wang, Christoph Hellwig, Andrew Morton,
Luis R. Rodriguez, guominchen, Eric W. Biederman,
Dominik Brodowski, Arnd Bergmann, linux-kernel, linux-mm
On Tue 18-12-18 13:24:44, gchen.guomin@gmail.com wrote:
> From: guomin chen <gchen.guomin@gmail.com>
>
> When mm->owner is modified by exit_mm, if the new owner directly calls
> unuse_mm to exit, it will cause Use-After-Free. Due to the unuse_mm()
> directly sets tsk->mm=NULL.
>
> Under normal circumstances,When do_exit exits, mm->owner will
> be updated on exit_mm(). but when the kernel process calls
> unuse_mm() and then exits,mm->owner cannot be updated. And it
> will point to a task that has been released.
>
> The current issue flow is as follows: (Process A,B,C use the same mm)
> Process C Process A Process B
> qemu-system-x86_64: kernel:vhost_net kernel: vhost_net
> open /dev/vhost-net
> VHOST_SET_OWNER create kthread vhost-%d create kthread vhost-%d
> network init use_mm() use_mm()
> ... ...
> Abnormal exited
> ...
> do_exit
> exit_mm()
> update mm->owner to A
> exit_files()
> close_files()
> kthread_should_stop() unuse_mm()
> Stop Process A tsk->mm=NULL
> do_exit()
> can't update owner
> A exit completed vhost-%d rcv first package
> vhost-%d build rcv buffer for vq
> page fault
> access mm & mm->owner
> NOW,mm->owner still pointer A
> kernel UAF
> stop Process B
>
> Although I am having this issue on vhost_net,But it affects all users of
> unuse_mm.
I am confused. How can we ever assign the owner to a kernel thread. We
skip those explicitly. It simply doesn't make any sense to have an owner
a kernel thread.
--
Michal Hocko
SUSE Labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Fix mm->owner point to a tsk that has been free
2018-12-18 9:52 ` Michal Hocko
@ 2018-12-18 16:21 ` gchen chen
2018-12-18 16:31 ` Matthew Wilcox
0 siblings, 1 reply; 5+ messages in thread
From: gchen chen @ 2018-12-18 16:21 UTC (permalink / raw)
To: Michal Hocko
Cc: Michael S. Tsirkin, Jason Wang, Christoph Hellwig, Andrew Morton,
Luis R. Rodriguez, gchen, Eric W. Biederman, Dominik Brodowski,
Arnd Bergmann, linux-kernel, linux-mm
[-- Attachment #1: Type: text/plain, Size: 2228 bytes --]
Oh, yes, the patch 39af176 has been skip the kthread
on mm_update_next_owner .
Thanks for your tips.
thanks and regards
Michal Hocko <mhocko@kernel.org> 于2018年12月18日周二 下午5:52写道:
> On Tue 18-12-18 13:24:44, gchen.guomin@gmail.com wrote:
> > From: guomin chen <gchen.guomin@gmail.com>
> >
> > When mm->owner is modified by exit_mm, if the new owner directly calls
> > unuse_mm to exit, it will cause Use-After-Free. Due to the unuse_mm()
> > directly sets tsk->mm=NULL.
> >
> > Under normal circumstances,When do_exit exits, mm->owner will
> > be updated on exit_mm(). but when the kernel process calls
> > unuse_mm() and then exits,mm->owner cannot be updated. And it
> > will point to a task that has been released.
> >
> > The current issue flow is as follows: (Process A,B,C use the same mm)
> > Process C Process A Process B
> > qemu-system-x86_64: kernel:vhost_net kernel: vhost_net
> > open /dev/vhost-net
> > VHOST_SET_OWNER create kthread vhost-%d create kthread vhost-%d
> > network init use_mm() use_mm()
> > ... ...
> > Abnormal exited
> > ...
> > do_exit
> > exit_mm()
> > update mm->owner to A
> > exit_files()
> > close_files()
> > kthread_should_stop() unuse_mm()
> > Stop Process A tsk->mm=NULL
> > do_exit()
> > can't update owner
> > A exit completed vhost-%d rcv first package
> > vhost-%d build rcv buffer for
> vq
> > page fault
> > access mm & mm->owner
> > NOW,mm->owner still pointer A
> > kernel UAF
> > stop Process B
> >
> > Although I am having this issue on vhost_net,But it affects all users of
> > unuse_mm.
>
> I am confused. How can we ever assign the owner to a kernel thread. We
> skip those explicitly. It simply doesn't make any sense to have an owner
> a kernel thread.
> --
> Michal Hocko
> SUSE Labs
>
[-- Attachment #2: Type: text/html, Size: 3213 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Fix mm->owner point to a tsk that has been free
2018-12-18 16:21 ` gchen chen
@ 2018-12-18 16:31 ` Matthew Wilcox
0 siblings, 0 replies; 5+ messages in thread
From: Matthew Wilcox @ 2018-12-18 16:31 UTC (permalink / raw)
To: gchen chen
Cc: Michal Hocko, Michael S. Tsirkin, Jason Wang, Christoph Hellwig,
Andrew Morton, Luis R. Rodriguez, gchen, Eric W. Biederman,
Dominik Brodowski, Arnd Bergmann, linux-kernel, linux-mm
On Wed, Dec 19, 2018 at 12:21:27AM +0800, gchen chen wrote:
> Oh, yes, the patch 39af176 has been skip the kthread
> on mm_update_next_owner .
Actually f87fb599ae4
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2018-12-18 16:31 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-18 5:24 [PATCH] Fix mm->owner point to a tsk that has been free gchen.guomin
2018-12-18 5:24 ` gchen.guomin
2018-12-18 9:52 ` Michal Hocko
2018-12-18 16:21 ` gchen chen
2018-12-18 16:31 ` Matthew Wilcox
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.