* mm: use-after-free in zap_page_range
@ 2017-03-03 13:54 Dmitry Vyukov
2017-03-03 16:23 ` Andrea Arcangeli
0 siblings, 1 reply; 3+ messages in thread
From: Dmitry Vyukov @ 2017-03-03 13:54 UTC (permalink / raw)
To: Andrew Morton, Kirill A. Shutemov, linux-mm, LKML,
Andrea Arcangeli, Andrey Ryabinin
Cc: syzkaller
Hello,
Yesterday Andrea helped me to extend syzkaller descriptions to
accommodate the new userfaultfd features:
https://github.com/google/syzkaller/commit/e7fc37e3cc9909ac38afc13e4f00c299d05cabf5
And here we go. UFFDIO_API seems to be necessary to trigger this. If
you add new APIs don't neglect to add syzkaller descriptions as well.
The following program triggers use-after-free in zap_page_range:
https://gist.githubusercontent.com/dvyukov/b59dfbaa0cb1e5231094d228fa57c9bd/raw/95c4da18cb96f8aaa47c10012d8c4484fd5917ad/gistfile1.txt
BUG: KASAN: use-after-free in zap_page_range+0x552/0x5c0
mm/memory.c:1399 at addr ffff880064daa540
Read of size 8 by task a.out/11690
CPU: 0 PID: 11690 Comm: a.out Not tainted 4.10.0+ #269
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__asan_report_load8_noabort+0x29/0x30 mm/kasan/report.c:331
zap_page_range+0x552/0x5c0 mm/memory.c:1399
madvise_dontneed mm/madvise.c:517 [inline]
madvise_vma mm/madvise.c:624 [inline]
SYSC_madvise mm/madvise.c:787 [inline]
SyS_madvise+0x6a0/0x1300 mm/madvise.c:716
entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x43fdb9
RSP: 002b:00007f563994cd98 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043fdb9
RDX: 0000000000000004 RSI: 0000000000003000 RDI: 0000000020011000
RBP: 0000000000000000 R08: 00007f563994d700 R09: 0000000000000000
R10: 00007f563994d700 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f563994d9c0 R15: 00007f563994d700
Object at ffff880064daa500, in cache vm_area_struct size: 192
Allocated:
PID = 11686
kmem_cache_alloc+0x102/0x6e0 mm/slab.c:3571
kmem_cache_zalloc include/linux/slab.h:653 [inline]
mmap_region+0xa36/0x18f0 mm/mmap.c:1643
do_mmap+0x6a6/0xd40 mm/mmap.c:1453
do_mmap_pgoff include/linux/mm.h:2100 [inline]
vm_mmap_pgoff+0x206/0x280 mm/util.c:307
SYSC_mmap_pgoff mm/mmap.c:1503 [inline]
SyS_mmap_pgoff+0x22c/0x5d0 mm/mmap.c:1461
SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 11691
__cache_free mm/slab.c:3513 [inline]
kmem_cache_free+0x71/0x240 mm/slab.c:3773
remove_vma+0x162/0x1b0 mm/mmap.c:175
remove_vma_list mm/mmap.c:2443 [inline]
do_munmap+0x945/0xff0 mm/mmap.c:2674
mmap_region+0x69d/0x18f0 mm/mmap.c:1616
do_mmap+0x6a6/0xd40 mm/mmap.c:1453
do_mmap_pgoff include/linux/mm.h:2100 [inline]
vm_mmap_pgoff+0x206/0x280 mm/util.c:307
SYSC_mmap_pgoff mm/mmap.c:1503 [inline]
SyS_mmap_pgoff+0x22c/0x5d0 mm/mmap.c:1461
SYSC_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
entry_SYSCALL_64_fastpath+0x1f/0xc2
Memory state around the buggy address:
ffff880064daa400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff880064daa480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff880064daa500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff880064daa580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff880064daa600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
On commit 4977ab6e92e267afe9d8f78438c3db330ca8434c
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: mm: use-after-free in zap_page_range
2017-03-03 13:54 mm: use-after-free in zap_page_range Dmitry Vyukov
@ 2017-03-03 16:23 ` Andrea Arcangeli
2017-03-08 12:51 ` Dmitry Vyukov
0 siblings, 1 reply; 3+ messages in thread
From: Andrea Arcangeli @ 2017-03-03 16:23 UTC (permalink / raw)
To: Dmitry Vyukov
Cc: Andrew Morton, Kirill A. Shutemov, linux-mm, LKML,
Andrey Ryabinin, syzkaller
Hello Dmitry,
On Fri, Mar 03, 2017 at 02:54:26PM +0100, Dmitry Vyukov wrote:
> The following program triggers use-after-free in zap_page_range:
> https://gist.githubusercontent.com/dvyukov/b59dfbaa0cb1e5231094d228fa57c9bd/raw/95c4da18cb96f8aaa47c10012d8c4484fd5917ad/gistfile1.txt
I posted the fix for this one yesterday (found while doing more code
reviews of the upstream code searching for any other potential issue):
https://www.spinics.net/lists/linux-mm/msg122905.html
https://www.spinics.net/lists/linux-mm/msg122903.html
Could you test with those two applied on top of the others updates
that are already in -mm?
Thanks!
Andrea
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: mm: use-after-free in zap_page_range
2017-03-03 16:23 ` Andrea Arcangeli
@ 2017-03-08 12:51 ` Dmitry Vyukov
0 siblings, 0 replies; 3+ messages in thread
From: Dmitry Vyukov @ 2017-03-08 12:51 UTC (permalink / raw)
To: Andrea Arcangeli
Cc: Andrew Morton, Kirill A. Shutemov, linux-mm, LKML,
Andrey Ryabinin, syzkaller
On Fri, Mar 3, 2017 at 5:23 PM, Andrea Arcangeli <aarcange@redhat.com> wrote:
> Hello Dmitry,
>
> On Fri, Mar 03, 2017 at 02:54:26PM +0100, Dmitry Vyukov wrote:
>> The following program triggers use-after-free in zap_page_range:
>> https://gist.githubusercontent.com/dvyukov/b59dfbaa0cb1e5231094d228fa57c9bd/raw/95c4da18cb96f8aaa47c10012d8c4484fd5917ad/gistfile1.txt
>
> I posted the fix for this one yesterday (found while doing more code
> reviews of the upstream code searching for any other potential issue):
>
> https://www.spinics.net/lists/linux-mm/msg122905.html
> https://www.spinics.net/lists/linux-mm/msg122903.html
>
> Could you test with those two applied on top of the others updates
> that are already in -mm?
This is already in mmotm/auto-latest, so we are testing it.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-03-08 12:52 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-03 13:54 mm: use-after-free in zap_page_range Dmitry Vyukov
2017-03-03 16:23 ` Andrea Arcangeli
2017-03-08 12:51 ` Dmitry Vyukov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).