From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.2 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9328CC433DB for ; Wed, 24 Mar 2021 13:32:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1F4F561A01 for ; Wed, 24 Mar 2021 13:32:48 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1F4F561A01 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7B7316B029A; Wed, 24 Mar 2021 09:32:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 767126B02AB; Wed, 24 Mar 2021 09:32:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 607FB6B02AD; Wed, 24 Mar 2021 09:32:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0148.hostedemail.com [216.40.44.148]) by kanga.kvack.org (Postfix) with ESMTP id 4750A6B029A for ; Wed, 24 Mar 2021 09:32:47 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 060F45DE5 for ; Wed, 24 Mar 2021 13:32:47 +0000 (UTC) X-FDA: 77954857974.06.9D1654C Received: from mail-lf1-f54.google.com (mail-lf1-f54.google.com [209.85.167.54]) by imf25.hostedemail.com (Postfix) with ESMTP id 67E976000117 for ; Wed, 24 Mar 2021 13:32:45 +0000 (UTC) Received: by mail-lf1-f54.google.com with SMTP id b14so18731039lfv.8 for ; Wed, 24 Mar 2021 06:32:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:date:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=MhDJbQFqmlzG4Q5PZ+EddHi8ImHiOeeMcvBa+QRSFmY=; b=OrvEY/UiOyO0t+M4n2uRkPQ2oZKBf3fQne2aSZagEC8NQraoyfxf93JfPvSuS69Wul RfKCoSNd2AAR6olqgHvz8OiEjcWZpPGJpEEfUh8LOyhXAt+WBQZWanrOBgMMasAjV380 MTKG/czF7hFYGxklWZnyxvGhhvlaffaTihu3V71sTXSHHFK3NEHe6OQJLn9+WWCeOtmS DaJeOMrS+BrVj/LFk9tIj1iMxDUKemMYIpCrtmilXE/ytDGRuKMoutE31nDiseA7G1A9 v7rYyi3tLM3Aue7FVvqjtMt0EJavpTSSOykFQJl58o2+vvgDwRQCsrlWyYWsfMVejU0f HhLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:date:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=MhDJbQFqmlzG4Q5PZ+EddHi8ImHiOeeMcvBa+QRSFmY=; b=Og+axrFlSpZpWa6USGAYQhuJZ2Jo2xV2RJlQcsSna26l3LzPbmcvaTc0jcx4X/C64F 2XNCPYDcNHTsPdPsjncqjek7VnB+WzS4A5YsHVfFOFsO9BPUnDWcIpwhyiaylNeyz739 IPOtkTCWZ5h1E+ken6p65YQtemWu/Mnn92+McH/thH2sipS7shTgDgNl3fL/dK2C9hEN XwEQbgcOQ0B6f3qCvNVSK+u3TQdGqOl849oKKAaD/iVIi4DQ+xnPCEr9o1jVWkGi0UuA ptnjIrvt1/JnIH/uW4w9S2K+iafQMNbik83wqExvTxO1+hdotSdSzcxWM6h9GvUo6oV6 rUzg== X-Gm-Message-State: AOAM533i/x6v/l2wA5BKPA7xHlPokjRkOm9Rj8YvcJZyymLC3BTMS7pv 5cWsgSkMAOubIYQ/CCvDIU8= X-Google-Smtp-Source: ABdhPJzp97PyjZ+uffvTaZygqpXWG7E/wrHLU7Kc0CxlVat/qjq8pxnjF37G+6/6h2L99Q6MRTshPg== X-Received: by 2002:a19:6611:: with SMTP id a17mr2036724lfc.244.1616592764824; Wed, 24 Mar 2021 06:32:44 -0700 (PDT) Received: from pc638.lan (h5ef52e3d.seluork.dyn.perspektivbredband.net. [94.245.46.61]) by smtp.gmail.com with ESMTPSA id w26sm312546ljm.38.2021.03.24.06.32.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Mar 2021 06:32:44 -0700 (PDT) From: Uladzislau Rezki X-Google-Original-From: Uladzislau Rezki Date: Wed, 24 Mar 2021 14:32:42 +0100 To: Vijayanand Jitta Cc: Uladzislau Rezki , akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, vinmenon@codeaurora.org Subject: Re: [PATCH] mm: vmalloc: Prevent use after free in _vm_unmap_aliases Message-ID: <20210324133242.GA1906@pc638.lan> References: <1616062105-23263-1-git-send-email-vjitta@codeaurora.org> <20210318165907.GA10448@pc638.lan> <803dc8ec-d1a2-ed26-ddab-a5258e60d318@codeaurora.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <803dc8ec-d1a2-ed26-ddab-a5258e60d318@codeaurora.org> User-Agent: Mutt/1.10.1 (2018-07-13) X-Stat-Signature: 5caoua1g8974549cbprd7cka1w7iczbu X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 67E976000117 Received-SPF: none (gmail.com>: No applicable sender policy available) receiver=imf25; identity=mailfrom; envelope-from=""; helo=mail-lf1-f54.google.com; client-ip=209.85.167.54 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1616592765-423835 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: > > On 3/18/2021 10:29 PM, Uladzislau Rezki wrote: > > On Thu, Mar 18, 2021 at 03:38:25PM +0530, vjitta@codeaurora.org wrote: > >> From: Vijayanand Jitta > >> > >> A potential use after free can occur in _vm_unmap_aliases > >> where an already freed vmap_area could be accessed, Consider > >> the following scenario: > >> > >> Process 1 Process 2 > >> > >> __vm_unmap_aliases __vm_unmap_aliases > >> purge_fragmented_blocks_allcpus rcu_read_lock() > >> rcu_read_lock() > >> list_del_rcu(&vb->free_list) > >> list_for_each_entry_rcu(vb .. ) > >> __purge_vmap_area_lazy > >> kmem_cache_free(va) > >> va_start = vb->va->va_start > > Or maybe we should switch to kfree_rcu() instead of kmem_cache_free()? > > > > -- > > Vlad Rezki > > > > Thanks for suggestion. > > I see free_vmap_area_lock (spinlock) is taken in __purge_vmap_area_lazy > while it loops through list and calls kmem_cache_free on va's. So, looks > like we can't replace it with kfree_rcu as it might cause scheduling > within atomic context. > A double argument of the kfree_rcu() is a safe way to be used from atomic contexts, it does not use any sleeping primitives, so it can be replaced. >From the other hand i see that per-cpu KVA allocator is only one user of the RCU and your change fixes it. Feel free to use: Reviewed-by: Uladzislau Rezki (Sony) Thanks. -- Vlad Rezki