From: zhong jiang <zhongjiang@huawei.com> To: Andrea Arcangeli <aarcange@redhat.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>, Peter Xu <peterx@redhat.com>, Andrew Morton <akpm@linux-foundation.org>, Dmitry Vyukov <dvyukov@google.com>, syzbot <syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com>, Michal Hocko <mhocko@kernel.org>, <cgroups@vger.kernel.org>, Johannes Weiner <hannes@cmpxchg.org>, LKML <linux-kernel@vger.kernel.org>, Linux-MM <linux-mm@kvack.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, Vladimir Davydov <vdavydov.dev@gmail.com>, David Rientjes <rientjes@google.com>, Hugh Dickins <hughd@google.com>, Matthew Wilcox <willy@infradead.org>, Mel Gorman <mgorman@suse.de>, Vlastimil Babka <vbabka@suse.cz> Subject: Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm Date: Mon, 18 Mar 2019 14:23:33 +0800 [thread overview] Message-ID: <5C8F3965.2050202@huawei.com> (raw) In-Reply-To: <20190316194222.GA29767@redhat.com> On 2019/3/17 3:42, Andrea Arcangeli wrote: > On Sat, Mar 16, 2019 at 05:38:54PM +0800, zhong jiang wrote: >> On 2019/3/16 5:39, Andrea Arcangeli wrote: >>> On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: >>>> I can reproduce the issue in arm64 qemu machine. The issue will leave after applying the >>>> patch. >>>> >>>> Tested-by: zhong jiang <zhongjiang@huawei.com> >>> Thanks a lot for the quick testing! >>> >>>> Meanwhile, I just has a little doubt whether it is necessary to use RCU to free the task struct or not. >>>> I think that mm->owner alway be NULL after failing to create to process. Because we call mm_clear_owner. >>> I wish it was enough, but the problem is that the other CPU may be in >>> the middle of get_mem_cgroup_from_mm() while this runs, and it would >>> dereference mm->owner while it is been freed without the call_rcu >>> affter we clear mm->owner. What prevents this race is the >> As you had said, It would dereference mm->owner after we clear mm->owner. >> >> But after we clear mm->owner, mm->owner should be NULL. Is it right? >> >> And mem_cgroup_from_task will check the parameter. >> you mean that it is possible after checking the parameter to clear the owner . >> and the NULL pointer will trigger. :-( > Dereference mm->owner didn't mean reading the value of the mm->owner > pointer, it really means to dereference the value of the pointer. It's > like below: > > get_mem_cgroup_from_mm() failing fork() > ---- --- > task = mm->owner > mm->owner = NULL; > free(mm->owner) > *task /* use after free */ > > We didn't set mm->owner to NULL before, so the window for the race was > larger, but setting mm->owner to NULL only hides the problem and it > can still happen (albeit with a smaller window). > > If get_mem_cgroup_from_mm() can see at any time mm->owner not NULL, > then the free of the task struct must be delayed until after > rcu_read_unlock has returned in get_mem_cgroup_from_mm(). This is > the standard RCU model, the freeing must be delayed until after the > next quiescent point. Thank you for your explaination patiently. The patch should go to upstream too. I think you should send a formal patch to the mainline. Maybe other people suffer from the issue. :-) Thanks, zhong jiang > BTW, both mm_update_next_owner() and mm_clear_owner() should have used > WRITE_ONCE when they write to mm->owner, I can update that too but > it's just to not to make assumptions that gcc does the right thing > (and we still rely on gcc to do the right thing in other places) so > that is just an orthogonal cleanup. > > Thanks, > Andrea > > . >
WARNING: multiple messages have this Message-ID (diff)
From: zhong jiang <zhongjiang@huawei.com> To: Andrea Arcangeli <aarcange@redhat.com> Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>, Peter Xu <peterx@redhat.com>, Andrew Morton <akpm@linux-foundation.org>, Dmitry Vyukov <dvyukov@google.com>, syzbot <syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com>, Michal Hocko <mhocko@kernel.org>, cgroups@vger.kernel.org, Johannes Weiner <hannes@cmpxchg.org>, LKML <linux-kernel@vger.kernel.org>, Linux-MM <linux-mm@kvack.org>, syzkaller-bugs <syzkaller-bugs@googlegroups.com>, Vladimir Davydov <vdavydov.dev@gmail.com>, David Rientjes <rientjes@google.com>, Hugh Dickins <hughd@google.com>, Matthew Wilcox <willy@infradead.org>, Mel Gorman <mgorman@suse.de>, Vlastimil Babka <vbabka@suse.cz> Subject: Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm Date: Mon, 18 Mar 2019 14:23:33 +0800 [thread overview] Message-ID: <5C8F3965.2050202@huawei.com> (raw) In-Reply-To: <20190316194222.GA29767@redhat.com> On 2019/3/17 3:42, Andrea Arcangeli wrote: > On Sat, Mar 16, 2019 at 05:38:54PM +0800, zhong jiang wrote: >> On 2019/3/16 5:39, Andrea Arcangeli wrote: >>> On Fri, Mar 08, 2019 at 03:10:08PM +0800, zhong jiang wrote: >>>> I can reproduce the issue in arm64 qemu machine. The issue will leave after applying the >>>> patch. >>>> >>>> Tested-by: zhong jiang <zhongjiang@huawei.com> >>> Thanks a lot for the quick testing! >>> >>>> Meanwhile, I just has a little doubt whether it is necessary to use RCU to free the task struct or not. >>>> I think that mm->owner alway be NULL after failing to create to process. Because we call mm_clear_owner. >>> I wish it was enough, but the problem is that the other CPU may be in >>> the middle of get_mem_cgroup_from_mm() while this runs, and it would >>> dereference mm->owner while it is been freed without the call_rcu >>> affter we clear mm->owner. What prevents this race is the >> As you had said, It would dereference mm->owner after we clear mm->owner. >> >> But after we clear mm->owner, mm->owner should be NULL. Is it right? >> >> And mem_cgroup_from_task will check the parameter. >> you mean that it is possible after checking the parameter to clear the owner . >> and the NULL pointer will trigger. :-( > Dereference mm->owner didn't mean reading the value of the mm->owner > pointer, it really means to dereference the value of the pointer. It's > like below: > > get_mem_cgroup_from_mm() failing fork() > ---- --- > task = mm->owner > mm->owner = NULL; > free(mm->owner) > *task /* use after free */ > > We didn't set mm->owner to NULL before, so the window for the race was > larger, but setting mm->owner to NULL only hides the problem and it > can still happen (albeit with a smaller window). > > If get_mem_cgroup_from_mm() can see at any time mm->owner not NULL, > then the free of the task struct must be delayed until after > rcu_read_unlock has returned in get_mem_cgroup_from_mm(). This is > the standard RCU model, the freeing must be delayed until after the > next quiescent point. Thank you for your explaination patiently. The patch should go to upstream too. I think you should send a formal patch to the mainline. Maybe other people suffer from the issue. :-) Thanks, zhong jiang > BTW, both mm_update_next_owner() and mm_clear_owner() should have used > WRITE_ONCE when they write to mm->owner, I can update that too but > it's just to not to make assumptions that gcc does the right thing > (and we still rely on gcc to do the right thing in other places) so > that is just an orthogonal cleanup. > > Thanks, > Andrea > > . >
next prev parent reply other threads:[~2019-03-18 6:23 UTC|newest] Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-11-07 1:52 KASAN: use-after-free Read in get_mem_cgroup_from_mm syzbot 2018-12-04 15:43 ` syzbot 2019-03-03 16:19 ` zhong jiang 2019-03-03 16:19 ` zhong jiang 2019-03-04 7:40 ` Dmitry Vyukov 2019-03-04 7:40 ` Dmitry Vyukov 2019-03-04 14:00 ` zhong jiang 2019-03-04 14:00 ` zhong jiang 2019-03-04 14:11 ` Dmitry Vyukov 2019-03-04 14:11 ` Dmitry Vyukov 2019-03-04 15:32 ` zhong jiang 2019-03-04 15:32 ` zhong jiang 2019-03-05 6:26 ` Dmitry Vyukov 2019-03-05 6:26 ` Dmitry Vyukov 2019-03-05 6:42 ` zhong jiang 2019-03-05 6:42 ` zhong jiang 2019-03-06 2:05 ` Andrea Arcangeli 2019-03-06 5:53 ` zhong jiang 2019-03-06 5:53 ` zhong jiang 2019-03-06 6:26 ` Mike Rapoport 2019-03-06 7:41 ` zhong jiang 2019-03-06 7:41 ` zhong jiang 2019-03-06 8:12 ` Peter Xu 2019-03-06 13:07 ` zhong jiang 2019-03-06 13:07 ` zhong jiang 2019-03-06 18:29 ` Andrea Arcangeli 2019-03-07 7:58 ` zhong jiang 2019-03-07 7:58 ` zhong jiang 2019-03-06 8:20 ` Mike Rapoport 2019-03-08 7:10 ` zhong jiang 2019-03-08 7:10 ` zhong jiang 2019-03-15 21:39 ` Andrea Arcangeli 2019-03-16 9:38 ` zhong jiang 2019-03-16 9:38 ` zhong jiang 2019-03-16 19:42 ` Andrea Arcangeli 2019-03-18 6:23 ` zhong jiang [this message] 2019-03-18 6:23 ` zhong jiang 2019-03-04 21:51 ` Matthew Wilcox 2019-03-05 3:09 ` zhong jiang 2019-03-05 3:09 ` zhong jiang 2019-03-22 9:36 ` syzbot 2019-03-22 9:36 ` syzbot
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=5C8F3965.2050202@huawei.com \ --to=zhongjiang@huawei.com \ --cc=aarcange@redhat.com \ --cc=akpm@linux-foundation.org \ --cc=cgroups@vger.kernel.org \ --cc=dvyukov@google.com \ --cc=hannes@cmpxchg.org \ --cc=hughd@google.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=mgorman@suse.de \ --cc=mhocko@kernel.org \ --cc=peterx@redhat.com \ --cc=rientjes@google.com \ --cc=rppt@linux.vnet.ibm.com \ --cc=syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com \ --cc=syzkaller-bugs@googlegroups.com \ --cc=vbabka@suse.cz \ --cc=vdavydov.dev@gmail.com \ --cc=willy@infradead.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.