* [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it
@ 2022-12-02 16:27 Jason A. Donenfeld
2022-12-02 16:33 ` Vlastimil Babka
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Jason A. Donenfeld @ 2022-12-02 16:27 UTC (permalink / raw)
To: akpm, linux-mm, linux-kernel, linux-hardening
Cc: Jason A. Donenfeld, Liam R . Howlett, Yu Zhao, Catalin Marinas,
David Hildenbrand, David Howells, Davidlohr Bueso,
Matthew Wilcox, SeongJae Park, Sven Schnelle, Vlastimil Babka,
Will Deacon
The following program will trigger the BUG_ON that this patch removes,
because the user can munmap() mm->brk:
#include <sys/syscall.h>
#include <sys/mman.h>
#include <assert.h>
#include <unistd.h>
static void *brk_now(void)
{
return (void *)syscall(SYS_brk, 0);
}
static void brk_set(void *b)
{
assert(syscall(SYS_brk, b) != -1);
}
int main(int argc, char *argv[])
{
void *b = brk_now();
brk_set(b + 4096);
assert(munmap(b - 4096, 4096 * 2) == 0);
brk_set(b);
return 0;
}
Compile that with musl, since glibc actually uses brk(), and then
execute it, and it'll hit this splat:
kernel BUG at mm/mmap.c:229!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 12 PID: 1379 Comm: a.out Tainted: G S U 6.1.0-rc7+ #419
RIP: 0010:__do_sys_brk+0x2fc/0x340
Code: 00 00 4c 89 ef e8 04 d3 fe ff eb 9a be 01 00 00 00 4c 89 ff e8 35 e0 fe ff e9 6e ff ff ff 4d 89 a7 20>
RSP: 0018:ffff888140bc7eb0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000007e7000 RCX: ffff8881020fe000
RDX: ffff8881020fe001 RSI: ffff8881955c9b00 RDI: ffff8881955c9b08
RBP: 0000000000000000 R08: ffff8881955c9b00 R09: 00007ffc77844000
R10: 0000000000000000 R11: 0000000000000001 R12: 00000000007e8000
R13: 00000000007e8000 R14: 00000000007e7000 R15: ffff8881020fe000
FS: 0000000000604298(0000) GS:ffff88901f700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000603fe0 CR3: 000000015ba9a005 CR4: 0000000000770ee0
PKRU: 55555554
Call Trace:
<TASK>
do_syscall_64+0x2b/0x50
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x400678
Code: 10 4c 8d 41 08 4c 89 44 24 10 4c 8b 01 8b 4c 24 08 83 f9 2f 77 0a 4c 8d 4c 24 20 4c 01 c9 eb 05 48 8b>
RSP: 002b:00007ffc77863890 EFLAGS: 00000212 ORIG_RAX: 000000000000000c
RAX: ffffffffffffffda RBX: 000000000040031b RCX: 0000000000400678
RDX: 00000000004006a1 RSI: 00000000007e6000 RDI: 00000000007e7000
RBP: 00007ffc77863900 R08: 0000000000000000 R09: 00000000007e6000
R10: 00007ffc77863930 R11: 0000000000000212 R12: 00007ffc77863978
R13: 00007ffc77863988 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Instead, just error out if the original mapping has been removed.
Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Yu Zhao <yuzhao@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: SeongJae Park <sj@kernel.org>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
mm/mmap.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/mm/mmap.c b/mm/mmap.c
index c3c5c1d6103d..f5a37fe9a19e 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
/* Search one past newbrk */
mas_set(&mas, newbrk);
brkvma = mas_find(&mas, oldbrk);
- BUG_ON(brkvma == NULL);
- if (brkvma->vm_start >= oldbrk)
+ if (!brkvma || brkvma->vm_start >= oldbrk)
goto out; /* mapping intersects with an existing non-brk vma. */
/*
* mm->brk must be protected by write mmap_lock.
--
2.38.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it
2022-12-02 16:27 [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it Jason A. Donenfeld
@ 2022-12-02 16:33 ` Vlastimil Babka
2022-12-02 16:57 ` Liam Howlett
2022-12-02 17:09 ` SeongJae Park
2 siblings, 0 replies; 4+ messages in thread
From: Vlastimil Babka @ 2022-12-02 16:33 UTC (permalink / raw)
To: Jason A. Donenfeld, akpm, linux-mm, linux-kernel, linux-hardening
Cc: Liam R . Howlett, Yu Zhao, Catalin Marinas, David Hildenbrand,
David Howells, Davidlohr Bueso, Matthew Wilcox, SeongJae Park,
Sven Schnelle, Will Deacon
On 12/2/22 17:27, Jason A. Donenfeld wrote:
> The following program will trigger the BUG_ON that this patch removes,
> because the user can munmap() mm->brk:
>
> #include <sys/syscall.h>
> #include <sys/mman.h>
> #include <assert.h>
> #include <unistd.h>
>
> static void *brk_now(void)
> {
> return (void *)syscall(SYS_brk, 0);
> }
>
> static void brk_set(void *b)
> {
> assert(syscall(SYS_brk, b) != -1);
> }
>
> int main(int argc, char *argv[])
> {
> void *b = brk_now();
> brk_set(b + 4096);
> assert(munmap(b - 4096, 4096 * 2) == 0);
> brk_set(b);
> return 0;
> }
>
> Compile that with musl, since glibc actually uses brk(), and then
> execute it, and it'll hit this splat:
>
> kernel BUG at mm/mmap.c:229!
> invalid opcode: 0000 [#1] PREEMPT SMP
> CPU: 12 PID: 1379 Comm: a.out Tainted: G S U 6.1.0-rc7+ #419
> RIP: 0010:__do_sys_brk+0x2fc/0x340
> Code: 00 00 4c 89 ef e8 04 d3 fe ff eb 9a be 01 00 00 00 4c 89 ff e8 35 e0 fe ff e9 6e ff ff ff 4d 89 a7 20>
> RSP: 0018:ffff888140bc7eb0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 00000000007e7000 RCX: ffff8881020fe000
> RDX: ffff8881020fe001 RSI: ffff8881955c9b00 RDI: ffff8881955c9b08
> RBP: 0000000000000000 R08: ffff8881955c9b00 R09: 00007ffc77844000
> R10: 0000000000000000 R11: 0000000000000001 R12: 00000000007e8000
> R13: 00000000007e8000 R14: 00000000007e7000 R15: ffff8881020fe000
> FS: 0000000000604298(0000) GS:ffff88901f700000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000603fe0 CR3: 000000015ba9a005 CR4: 0000000000770ee0
> PKRU: 55555554
> Call Trace:
> <TASK>
> do_syscall_64+0x2b/0x50
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> RIP: 0033:0x400678
> Code: 10 4c 8d 41 08 4c 89 44 24 10 4c 8b 01 8b 4c 24 08 83 f9 2f 77 0a 4c 8d 4c 24 20 4c 01 c9 eb 05 48 8b>
> RSP: 002b:00007ffc77863890 EFLAGS: 00000212 ORIG_RAX: 000000000000000c
> RAX: ffffffffffffffda RBX: 000000000040031b RCX: 0000000000400678
> RDX: 00000000004006a1 RSI: 00000000007e6000 RDI: 00000000007e7000
> RBP: 00007ffc77863900 R08: 0000000000000000 R09: 00000000007e6000
> R10: 00007ffc77863930 R11: 0000000000000212 R12: 00007ffc77863978
> R13: 00007ffc77863988 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
> Instead, just error out if the original mapping has been removed.
>
> Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")
That's 6.1-rc1 so probably fast track to Linus as we don't need to introduce
such trivial local user DoS in 6.1, right?
> Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
> Cc: Yu Zhao <yuzhao@google.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: David Hildenbrand <david@redhat.com>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Davidlohr Bueso <dave@stgolabs.net>
> Cc: Matthew Wilcox <willy@infradead.org>
> Cc: SeongJae Park <sj@kernel.org>
> Cc: Sven Schnelle <svens@linux.ibm.com>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> Cc: Will Deacon <will@kernel.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
> ---
> mm/mmap.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index c3c5c1d6103d..f5a37fe9a19e 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
> /* Search one past newbrk */
> mas_set(&mas, newbrk);
> brkvma = mas_find(&mas, oldbrk);
> - BUG_ON(brkvma == NULL);
> - if (brkvma->vm_start >= oldbrk)
> + if (!brkvma || brkvma->vm_start >= oldbrk)
> goto out; /* mapping intersects with an existing non-brk vma. */
> /*
> * mm->brk must be protected by write mmap_lock.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it
2022-12-02 16:27 [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it Jason A. Donenfeld
2022-12-02 16:33 ` Vlastimil Babka
@ 2022-12-02 16:57 ` Liam Howlett
2022-12-02 17:09 ` SeongJae Park
2 siblings, 0 replies; 4+ messages in thread
From: Liam Howlett @ 2022-12-02 16:57 UTC (permalink / raw)
To: Jason A. Donenfeld
Cc: akpm, linux-mm, linux-kernel, linux-hardening, Yu Zhao,
Catalin Marinas, David Hildenbrand, David Howells,
Davidlohr Bueso, Matthew Wilcox, SeongJae Park, Sven Schnelle,
Vlastimil Babka, Will Deacon
* Jason A. Donenfeld <Jason@zx2c4.com> [221202 11:27]:
> The following program will trigger the BUG_ON that this patch removes,
> because the user can munmap() mm->brk:
>
> #include <sys/syscall.h>
> #include <sys/mman.h>
> #include <assert.h>
> #include <unistd.h>
>
> static void *brk_now(void)
> {
> return (void *)syscall(SYS_brk, 0);
> }
>
> static void brk_set(void *b)
> {
> assert(syscall(SYS_brk, b) != -1);
> }
>
> int main(int argc, char *argv[])
> {
> void *b = brk_now();
> brk_set(b + 4096);
> assert(munmap(b - 4096, 4096 * 2) == 0);
> brk_set(b);
> return 0;
> }
>
> Compile that with musl, since glibc actually uses brk(), and then
> execute it, and it'll hit this splat:
>
> kernel BUG at mm/mmap.c:229!
> invalid opcode: 0000 [#1] PREEMPT SMP
> CPU: 12 PID: 1379 Comm: a.out Tainted: G S U 6.1.0-rc7+ #419
> RIP: 0010:__do_sys_brk+0x2fc/0x340
> Code: 00 00 4c 89 ef e8 04 d3 fe ff eb 9a be 01 00 00 00 4c 89 ff e8 35 e0 fe ff e9 6e ff ff ff 4d 89 a7 20>
> RSP: 0018:ffff888140bc7eb0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 00000000007e7000 RCX: ffff8881020fe000
> RDX: ffff8881020fe001 RSI: ffff8881955c9b00 RDI: ffff8881955c9b08
> RBP: 0000000000000000 R08: ffff8881955c9b00 R09: 00007ffc77844000
> R10: 0000000000000000 R11: 0000000000000001 R12: 00000000007e8000
> R13: 00000000007e8000 R14: 00000000007e7000 R15: ffff8881020fe000
> FS: 0000000000604298(0000) GS:ffff88901f700000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000603fe0 CR3: 000000015ba9a005 CR4: 0000000000770ee0
> PKRU: 55555554
> Call Trace:
> <TASK>
> do_syscall_64+0x2b/0x50
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> RIP: 0033:0x400678
> Code: 10 4c 8d 41 08 4c 89 44 24 10 4c 8b 01 8b 4c 24 08 83 f9 2f 77 0a 4c 8d 4c 24 20 4c 01 c9 eb 05 48 8b>
> RSP: 002b:00007ffc77863890 EFLAGS: 00000212 ORIG_RAX: 000000000000000c
> RAX: ffffffffffffffda RBX: 000000000040031b RCX: 0000000000400678
> RDX: 00000000004006a1 RSI: 00000000007e6000 RDI: 00000000007e7000
> RBP: 00007ffc77863900 R08: 0000000000000000 R09: 00000000007e6000
> R10: 00007ffc77863930 R11: 0000000000000212 R12: 00007ffc77863978
> R13: 00007ffc77863988 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
> Instead, just error out if the original mapping has been removed.
>
> Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")
> Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
> Cc: Yu Zhao <yuzhao@google.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: David Hildenbrand <david@redhat.com>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Davidlohr Bueso <dave@stgolabs.net>
> Cc: Matthew Wilcox <willy@infradead.org>
> Cc: SeongJae Park <sj@kernel.org>
> Cc: Sven Schnelle <svens@linux.ibm.com>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> Cc: Will Deacon <will@kernel.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> ---
> mm/mmap.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index c3c5c1d6103d..f5a37fe9a19e 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
> /* Search one past newbrk */
> mas_set(&mas, newbrk);
> brkvma = mas_find(&mas, oldbrk);
> - BUG_ON(brkvma == NULL);
> - if (brkvma->vm_start >= oldbrk)
> + if (!brkvma || brkvma->vm_start >= oldbrk)
> goto out; /* mapping intersects with an existing non-brk vma. */
nit: The out label does not return an error as you specified in the
comment, it returns "origbrk" doesn't it?
I actually had something like this prepared to reduce the calls to
BUG_ON(), but I like this better.
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
> /*
> * mm->brk must be protected by write mmap_lock.
> --
> 2.38.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it
2022-12-02 16:27 [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it Jason A. Donenfeld
2022-12-02 16:33 ` Vlastimil Babka
2022-12-02 16:57 ` Liam Howlett
@ 2022-12-02 17:09 ` SeongJae Park
2 siblings, 0 replies; 4+ messages in thread
From: SeongJae Park @ 2022-12-02 17:09 UTC (permalink / raw)
To: Jason A. Donenfeld
Cc: akpm, linux-mm, linux-kernel, linux-hardening, Liam R . Howlett,
Yu Zhao, Catalin Marinas, David Hildenbrand, David Howells,
Davidlohr Bueso, Matthew Wilcox, SeongJae Park, Sven Schnelle,
Vlastimil Babka, Will Deacon
On Fri, 2 Dec 2022 17:27:24 +0100 "Jason A. Donenfeld" <Jason@zx2c4.com> wrote:
> The following program will trigger the BUG_ON that this patch removes,
> because the user can munmap() mm->brk:
>
> #include <sys/syscall.h>
> #include <sys/mman.h>
> #include <assert.h>
> #include <unistd.h>
>
> static void *brk_now(void)
> {
> return (void *)syscall(SYS_brk, 0);
> }
>
> static void brk_set(void *b)
> {
> assert(syscall(SYS_brk, b) != -1);
> }
>
> int main(int argc, char *argv[])
> {
> void *b = brk_now();
> brk_set(b + 4096);
> assert(munmap(b - 4096, 4096 * 2) == 0);
> brk_set(b);
> return 0;
> }
>
> Compile that with musl, since glibc actually uses brk(), and then
> execute it, and it'll hit this splat:
>
> kernel BUG at mm/mmap.c:229!
> invalid opcode: 0000 [#1] PREEMPT SMP
> CPU: 12 PID: 1379 Comm: a.out Tainted: G S U 6.1.0-rc7+ #419
> RIP: 0010:__do_sys_brk+0x2fc/0x340
> Code: 00 00 4c 89 ef e8 04 d3 fe ff eb 9a be 01 00 00 00 4c 89 ff e8 35 e0 fe ff e9 6e ff ff ff 4d 89 a7 20>
> RSP: 0018:ffff888140bc7eb0 EFLAGS: 00010246
> RAX: 0000000000000000 RBX: 00000000007e7000 RCX: ffff8881020fe000
> RDX: ffff8881020fe001 RSI: ffff8881955c9b00 RDI: ffff8881955c9b08
> RBP: 0000000000000000 R08: ffff8881955c9b00 R09: 00007ffc77844000
> R10: 0000000000000000 R11: 0000000000000001 R12: 00000000007e8000
> R13: 00000000007e8000 R14: 00000000007e7000 R15: ffff8881020fe000
> FS: 0000000000604298(0000) GS:ffff88901f700000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000603fe0 CR3: 000000015ba9a005 CR4: 0000000000770ee0
> PKRU: 55555554
> Call Trace:
> <TASK>
> do_syscall_64+0x2b/0x50
> entry_SYSCALL_64_after_hwframe+0x46/0xb0
> RIP: 0033:0x400678
> Code: 10 4c 8d 41 08 4c 89 44 24 10 4c 8b 01 8b 4c 24 08 83 f9 2f 77 0a 4c 8d 4c 24 20 4c 01 c9 eb 05 48 8b>
> RSP: 002b:00007ffc77863890 EFLAGS: 00000212 ORIG_RAX: 000000000000000c
> RAX: ffffffffffffffda RBX: 000000000040031b RCX: 0000000000400678
> RDX: 00000000004006a1 RSI: 00000000007e6000 RDI: 00000000007e7000
> RBP: 00007ffc77863900 R08: 0000000000000000 R09: 00000000007e6000
> R10: 00007ffc77863930 R11: 0000000000000212 R12: 00007ffc77863978
> R13: 00007ffc77863988 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
> Instead, just error out if the original mapping has been removed.
>
> Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")
> Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
> Cc: Yu Zhao <yuzhao@google.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: David Hildenbrand <david@redhat.com>
> Cc: David Howells <dhowells@redhat.com>
> Cc: Davidlohr Bueso <dave@stgolabs.net>
> Cc: Matthew Wilcox <willy@infradead.org>
> Cc: SeongJae Park <sj@kernel.org>
> Cc: Sven Schnelle <svens@linux.ibm.com>
> Cc: Vlastimil Babka <vbabka@suse.cz>
> Cc: Will Deacon <will@kernel.org>
> Cc: Andrew Morton <akpm@linux-foundation.org>
> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Thanks,
SJ
> ---
> mm/mmap.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/mm/mmap.c b/mm/mmap.c
> index c3c5c1d6103d..f5a37fe9a19e 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -226,8 +226,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
> /* Search one past newbrk */
> mas_set(&mas, newbrk);
> brkvma = mas_find(&mas, oldbrk);
> - BUG_ON(brkvma == NULL);
> - if (brkvma->vm_start >= oldbrk)
> + if (!brkvma || brkvma->vm_start >= oldbrk)
> goto out; /* mapping intersects with an existing non-brk vma. */
> /*
> * mm->brk must be protected by write mmap_lock.
> --
> 2.38.1
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-12-02 17:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-02 16:27 [PATCH] mm: do not BUG_ON missing brk mapping, because userspace can unmap it Jason A. Donenfeld
2022-12-02 16:33 ` Vlastimil Babka
2022-12-02 16:57 ` Liam Howlett
2022-12-02 17:09 ` SeongJae Park
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.