linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, cai@lca.pw, linux-mm@kvack.org,
	mm-commits@vger.kernel.org, shentino@gmail.com,
	stable@vger.kernel.org, torvalds@linux-foundation.org,
	uladzislau.rezki@sony.com, vitaly.wool@konsulko.com
Subject: [patch 10/11] z3fold: fix use-after-free when freeing handles
Date: Fri, 22 May 2020 22:23:12 -0700	[thread overview]
Message-ID: <20200523052312.8XR1NwGDV%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200522222217.ee14ad7eda7aab1e6697da6c@linux-foundation.org>

From: Uladzislau Rezki <uladzislau.rezki@sony.com>
Subject: z3fold: fix use-after-free when freeing handles

free_handle() for a foreign handle may race with inter-page compaction,
what can lead to memory corruption.  To avoid that, take write lock not
read lock in free_handle to be synchronized with __release_z3fold_page().

For example KASAN can detect it:

[   33.723357] ==================================================================
[   33.723401] BUG: KASAN: use-after-free in LZ4_decompress_safe+0x2c4/0x3b8
[   33.723418] Read of size 1 at addr ffffffc976695ca3 by task GoogleApiHandle/4121
[   33.723428]
[   33.723449] CPU: 0 PID: 4121 Comm: GoogleApiHandle Tainted: P S         OE     4.19.81-perf+ #162
[   33.723461] Hardware name: Sony Mobile Communications. PDX-203(KONA) (DT)
[   33.723473] Call trace:
[   33.723495] dump_backtrace+0x0/0x288
[   33.723512] show_stack+0x14/0x20
[   33.723533] dump_stack+0xe4/0x124
[   33.723551] print_address_description+0x80/0x2e0
[   33.723566] kasan_report+0x268/0x2d0
[   33.723584] __asan_load1+0x4c/0x58
[   33.723601] LZ4_decompress_safe+0x2c4/0x3b8
[   33.723619] lz4_decompress_crypto+0x3c/0x70
[   33.723636] crypto_decompress+0x58/0x70
[   33.723656] zcomp_decompress+0xd4/0x120
...

Apart from that, initialize zhdr->mapped_count in init_z3fold_page() and
remove "newpage" variable because it is not used anywhere.

Link: http://lkml.kernel.org/r/20200520082100.28876-1-vitaly.wool@konsulko.com
Signed-off-by: Uladzislau Rezki <uladzislau.rezki@sony.com>
Signed-off-by: Vitaly Wool <vitaly.wool@konsulko.com>
Cc: Qian Cai <cai@lca.pw>
Cc: Raymond Jennings <shentino@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/z3fold.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/mm/z3fold.c~z3fold-fix-use-after-free-when-freeing-handles
+++ a/mm/z3fold.c
@@ -318,16 +318,16 @@ static inline void free_handle(unsigned
 	slots = handle_to_slots(handle);
 	write_lock(&slots->lock);
 	*(unsigned long *)handle = 0;
-	write_unlock(&slots->lock);
-	if (zhdr->slots == slots)
+	if (zhdr->slots == slots) {
+		write_unlock(&slots->lock);
 		return; /* simple case, nothing else to do */
+	}
 
 	/* we are freeing a foreign handle if we are here */
 	zhdr->foreign_handles--;
 	is_free = true;
-	read_lock(&slots->lock);
 	if (!test_bit(HANDLES_ORPHANED, &slots->pool)) {
-		read_unlock(&slots->lock);
+		write_unlock(&slots->lock);
 		return;
 	}
 	for (i = 0; i <= BUDDY_MASK; i++) {
@@ -336,7 +336,7 @@ static inline void free_handle(unsigned
 			break;
 		}
 	}
-	read_unlock(&slots->lock);
+	write_unlock(&slots->lock);
 
 	if (is_free) {
 		struct z3fold_pool *pool = slots_to_pool(slots);
@@ -422,6 +422,7 @@ static struct z3fold_header *init_z3fold
 	zhdr->start_middle = 0;
 	zhdr->cpu = -1;
 	zhdr->foreign_handles = 0;
+	zhdr->mapped_count = 0;
 	zhdr->slots = slots;
 	zhdr->pool = pool;
 	INIT_LIST_HEAD(&zhdr->buddy);
_


  parent reply	other threads:[~2020-05-23  5:23 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-23  5:22 incoming Andrew Morton
2020-05-23  5:22 ` [patch 01/11] device-dax: don't leak kernel memory to user space after unloading kmem Andrew Morton
2020-05-23  5:22 ` [patch 02/11] x86: bitops: fix build regression Andrew Morton
2020-05-23  5:22 ` [patch 03/11] rapidio: fix an error in get_user_pages_fast() error handling Andrew Morton
2020-05-23  5:22 ` [patch 04/11] selftests/vm/.gitignore: add mremap_dontunmap Andrew Morton
2020-05-23  5:22 ` [patch 05/11] selftests/vm/write_to_hugetlbfs.c: fix unused variable warning Andrew Morton
2020-05-23  5:22 ` [patch 06/11] kasan: disable branch tracing for core runtime Andrew Morton
2020-05-23  5:23 ` [patch 07/11] sh: include linux/time_types.h for sockios Andrew Morton
2020-05-23  5:23 ` [patch 08/11] MAINTAINERS: update email address for Naoya Horiguchi Andrew Morton
2020-05-23  5:23 ` [patch 09/11] sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() Andrew Morton
2020-05-23 19:01   ` Mike Rapoport
2020-05-23 19:10     ` Linus Torvalds
2020-05-23 19:57       ` Mike Rapoport
2020-05-23  5:23 ` Andrew Morton [this message]
2020-05-23  5:23 ` [patch 11/11] MAINTAINERS: add files related to kdump Andrew Morton
2020-05-25  5:10 ` mmotm 2020-05-24-22-09 uploaded Andrew Morton
2020-05-25 23:57 ` mmotm 2020-05-25-16-56 uploaded Andrew Morton
2020-05-26  3:49   ` mmotm 2020-05-25-16-56 uploaded (drm/nouveau) Randy Dunlap
2020-05-26  4:23     ` Dave Airlie
2020-05-26  4:31       ` Randy Dunlap
2020-05-26  6:56   ` mmotm 2020-05-25-16-56 uploaded (mtd/nand/raw/arasan-nand-controller) Randy Dunlap
2020-05-26 19:37     ` Miquel Raynal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200523052312.8XR1NwGDV%akpm@linux-foundation.org \
    --to=akpm@linux-foundation.org \
    --cc=cai@lca.pw \
    --cc=linux-mm@kvack.org \
    --cc=mm-commits@vger.kernel.org \
    --cc=shentino@gmail.com \
    --cc=stable@vger.kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=uladzislau.rezki@sony.com \
    --cc=vitaly.wool@konsulko.com \
    --subject='Re: [patch 10/11] z3fold: fix use-after-free when freeing handles' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
on how to clone and mirror all data and code used for this inbox