From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB06BC43461 for ; Tue, 8 Sep 2020 10:48:58 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 29FC8206DB for ; Tue, 8 Sep 2020 10:48:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SjmhBNjj" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 29FC8206DB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 7794E8E0001; Tue, 8 Sep 2020 06:48:57 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 728DF6B0055; Tue, 8 Sep 2020 06:48:57 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5F20B8E0001; Tue, 8 Sep 2020 06:48:57 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0190.hostedemail.com [216.40.44.190]) by kanga.kvack.org (Postfix) with ESMTP id 48B1E6B0037 for ; Tue, 8 Sep 2020 06:48:57 -0400 (EDT) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 06E771EE6 for ; Tue, 8 Sep 2020 10:48:57 +0000 (UTC) X-FDA: 77239571514.17.paste64_3906a6c270d4 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id B1A47180D0184 for ; Tue, 8 Sep 2020 10:48:56 +0000 (UTC) X-HE-Tag: paste64_3906a6c270d4 X-Filterd-Recvd-Size: 10156 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [205.139.110.61]) by imf23.hostedemail.com (Postfix) with ESMTP for ; Tue, 8 Sep 2020 10:48:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1599562135; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=ybSOEqAGunx5x8hnbfmKb5dvLAh/55pJvdpB5yxrLkE=; b=SjmhBNjjT3s64b8nwMcBAzzlKykpUZzcm956B4RF+MVOPnFxVALWm3tjk0LELuI9Cxux++ wQvIF5pXgM3uUEwieOxmSHQ8UKG+3tvON/2B+OY9gMvIcm44QurCk2sqNvrGjhaSOwZL49 O6EDP0UANifVoEQIetTAueI4dgJeb70= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-58-eIH3M3hLPX6hOWuEtuZKfw-1; Tue, 08 Sep 2020 06:48:51 -0400 X-MC-Unique: eIH3M3hLPX6hOWuEtuZKfw-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 739E38018AB; Tue, 8 Sep 2020 10:48:50 +0000 (UTC) Received: from [10.36.115.46] (ovpn-115-46.ams2.redhat.com [10.36.115.46]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0B0F710013C4; Tue, 8 Sep 2020 10:48:48 +0000 (UTC) Subject: Re: [PATCH] mm: madvise: fix vma user-after-free To: Yang Shi , jack@suse.cz, akpm@linux-foundation.org Cc: stable@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org References: <20200816141204.162624-1-shy828301@gmail.com> From: David Hildenbrand Autocrypt: addr=david@redhat.com; prefer-encrypt=mutual; keydata= mQINBFXLn5EBEAC+zYvAFJxCBY9Tr1xZgcESmxVNI/0ffzE/ZQOiHJl6mGkmA1R7/uUpiCjJ dBrn+lhhOYjjNefFQou6478faXE6o2AhmebqT4KiQoUQFV4R7y1KMEKoSyy8hQaK1umALTdL QZLQMzNE74ap+GDK0wnacPQFpcG1AE9RMq3aeErY5tujekBS32jfC/7AnH7I0v1v1TbbK3Gp XNeiN4QroO+5qaSr0ID2sz5jtBLRb15RMre27E1ImpaIv2Jw8NJgW0k/D1RyKCwaTsgRdwuK Kx/Y91XuSBdz0uOyU/S8kM1+ag0wvsGlpBVxRR/xw/E8M7TEwuCZQArqqTCmkG6HGcXFT0V9 PXFNNgV5jXMQRwU0O/ztJIQqsE5LsUomE//bLwzj9IVsaQpKDqW6TAPjcdBDPLHvriq7kGjt WhVhdl0qEYB8lkBEU7V2Yb+SYhmhpDrti9Fq1EsmhiHSkxJcGREoMK/63r9WLZYI3+4W2rAc UucZa4OT27U5ZISjNg3Ev0rxU5UH2/pT4wJCfxwocmqaRr6UYmrtZmND89X0KigoFD/XSeVv jwBRNjPAubK9/k5NoRrYqztM9W6sJqrH8+UWZ1Idd/DdmogJh0gNC0+N42Za9yBRURfIdKSb B3JfpUqcWwE7vUaYrHG1nw54pLUoPG6sAA7Mehl3nd4pZUALHwARAQABtCREYXZpZCBIaWxk ZW5icmFuZCA8ZGF2aWRAcmVkaGF0LmNvbT6JAlgEEwEIAEICGwMGCwkIBwMCBhUIAgkKCwQW AgMBAh4BAheAAhkBFiEEG9nKrXNcTDpGDfzKTd4Q9wD/g1oFAl8Ox4kFCRKpKXgACgkQTd4Q 9wD/g1oHcA//a6Tj7SBNjFNM1iNhWUo1lxAja0lpSodSnB2g4FCZ4R61SBR4l/psBL73xktp rDHrx4aSpwkRP6Epu6mLvhlfjmkRG4OynJ5HG1gfv7RJJfnUdUM1z5kdS8JBrOhMJS2c/gPf wv1TGRq2XdMPnfY2o0CxRqpcLkx4vBODvJGl2mQyJF/gPepdDfcT8/PY9BJ7FL6Hrq1gnAo4 3Iv9qV0JiT2wmZciNyYQhmA1V6dyTRiQ4YAc31zOo2IM+xisPzeSHgw3ONY/XhYvfZ9r7W1l pNQdc2G+o4Di9NPFHQQhDw3YTRR1opJaTlRDzxYxzU6ZnUUBghxt9cwUWTpfCktkMZiPSDGd KgQBjnweV2jw9UOTxjb4LXqDjmSNkjDdQUOU69jGMUXgihvo4zhYcMX8F5gWdRtMR7DzW/YE BgVcyxNkMIXoY1aYj6npHYiNQesQlqjU6azjbH70/SXKM5tNRplgW8TNprMDuntdvV9wNkFs 9TyM02V5aWxFfI42+aivc4KEw69SE9KXwC7FSf5wXzuTot97N9Phj/Z3+jx443jo2NR34XgF 89cct7wJMjOF7bBefo0fPPZQuIma0Zym71cP61OP/i11ahNye6HGKfxGCOcs5wW9kRQEk8P9 M/k2wt3mt/fCQnuP/mWutNPt95w9wSsUyATLmtNrwccz63W5Ag0EVcufkQEQAOfX3n0g0fZz Bgm/S2zF/kxQKCEKP8ID+Vz8sy2GpDvveBq4H2Y34XWsT1zLJdvqPI4af4ZSMxuerWjXbVWb T6d4odQIG0fKx4F8NccDqbgHeZRNajXeeJ3R7gAzvWvQNLz4piHrO/B4tf8svmRBL0ZB5P5A 2uhdwLU3NZuK22zpNn4is87BPWF8HhY0L5fafgDMOqnf4guJVJPYNPhUFzXUbPqOKOkL8ojk CXxkOFHAbjstSK5Ca3fKquY3rdX3DNo+EL7FvAiw1mUtS+5GeYE+RMnDCsVFm/C7kY8c2d0G NWkB9pJM5+mnIoFNxy7YBcldYATVeOHoY4LyaUWNnAvFYWp08dHWfZo9WCiJMuTfgtH9tc75 7QanMVdPt6fDK8UUXIBLQ2TWr/sQKE9xtFuEmoQGlE1l6bGaDnnMLcYu+Asp3kDT0w4zYGsx 5r6XQVRH4+5N6eHZiaeYtFOujp5n+pjBaQK7wUUjDilPQ5QMzIuCL4YjVoylWiBNknvQWBXS lQCWmavOT9sttGQXdPCC5ynI+1ymZC1ORZKANLnRAb0NH/UCzcsstw2TAkFnMEbo9Zu9w7Kv AxBQXWeXhJI9XQssfrf4Gusdqx8nPEpfOqCtbbwJMATbHyqLt7/oz/5deGuwxgb65pWIzufa N7eop7uh+6bezi+rugUI+w6DABEBAAGJAjwEGAEIACYCGwwWIQQb2cqtc1xMOkYN/MpN3hD3 AP+DWgUCXw7HsgUJEqkpoQAKCRBN3hD3AP+DWrrpD/4qS3dyVRxDcDHIlmguXjC1Q5tZTwNB boaBTPHSy/Nksu0eY7x6HfQJ3xajVH32Ms6t1trDQmPx2iP5+7iDsb7OKAb5eOS8h+BEBDeq 3ecsQDv0fFJOA9ag5O3LLNk+3x3q7e0uo06XMaY7UHS341ozXUUI7wC7iKfoUTv03iO9El5f XpNMx/YrIMduZ2+nd9Di7o5+KIwlb2mAB9sTNHdMrXesX8eBL6T9b+MZJk+mZuPxKNVfEQMQ a5SxUEADIPQTPNvBewdeI80yeOCrN+Zzwy/Mrx9EPeu59Y5vSJOx/z6OUImD/GhX7Xvkt3kq Er5KTrJz3++B6SH9pum9PuoE/k+nntJkNMmQpR4MCBaV/J9gIOPGodDKnjdng+mXliF3Ptu6 3oxc2RCyGzTlxyMwuc2U5Q7KtUNTdDe8T0uE+9b8BLMVQDDfJjqY0VVqSUwImzTDLX9S4g/8 kC4HRcclk8hpyhY2jKGluZO0awwTIMgVEzmTyBphDg/Gx7dZU1Xf8HFuE+UZ5UDHDTnwgv7E th6RC9+WrhDNspZ9fJjKWRbveQgUFCpe1sa77LAw+XFrKmBHXp9ZVIe90RMe2tRL06BGiRZr jPrnvUsUUsjRoRNJjKKA/REq+sAnhkNPPZ/NNMjaZ5b8Tovi8C0tmxiCHaQYqj7G2rgnT0kt WNyWQQ== Organization: Red Hat GmbH Message-ID: <90653e03-1a7c-01b4-546d-d725475e65e1@redhat.com> Date: Tue, 8 Sep 2020 12:48:48 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <20200816141204.162624-1-shy828301@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Rspamd-Queue-Id: B1A47180D0184 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000078, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 16.08.20 16:12, Yang Shi wrote: > The syzbot reported the below use-after-free: > > BUG: KASAN: use-after-free in madvise_willneed mm/madvise.c:293 [inline] > BUG: KASAN: use-after-free in madvise_vma mm/madvise.c:942 [inline] > BUG: KASAN: use-after-free in do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145 > Read of size 8 at addr ffff8880a6163eb0 by task syz-executor.0/9996 > > CPU: 0 PID: 9996 Comm: syz-executor.0 Not tainted 5.9.0-rc1-syzkaller #0 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > Call Trace: > __dump_stack lib/dump_stack.c:77 [inline] > dump_stack+0x18f/0x20d lib/dump_stack.c:118 > print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 > __kasan_report mm/kasan/report.c:513 [inline] > kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 > madvise_willneed mm/madvise.c:293 [inline] > madvise_vma mm/madvise.c:942 [inline] > do_madvise.part.0+0x1c8b/0x1cf0 mm/madvise.c:1145 > do_madvise mm/madvise.c:1169 [inline] > __do_sys_madvise mm/madvise.c:1171 [inline] > __se_sys_madvise mm/madvise.c:1169 [inline] > __x64_sys_madvise+0xd9/0x110 mm/madvise.c:1169 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > RIP: 0033:0x45d4d9 > Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 > RSP: 002b:00007f04f7464c78 EFLAGS: 00000246 ORIG_RAX: 000000000000001c > RAX: ffffffffffffffda RBX: 0000000000020800 RCX: 000000000045d4d9 > RDX: 0000000000000003 RSI: 0000000000600003 RDI: 0000000020000000 > RBP: 000000000118d020 R08: 0000000000000000 R09: 0000000000000000 > R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118cfec > R13: 00007ffc579cce7f R14: 00007f04f74659c0 R15: 000000000118cfec > > Allocated by task 9992: > kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 > kasan_set_track mm/kasan/common.c:56 [inline] > __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 > slab_post_alloc_hook mm/slab.h:518 [inline] > slab_alloc mm/slab.c:3312 [inline] > kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482 > vm_area_alloc+0x1c/0x110 kernel/fork.c:347 > mmap_region+0x8e5/0x1780 mm/mmap.c:1743 > do_mmap+0xcf9/0x11d0 mm/mmap.c:1545 > vm_mmap_pgoff+0x195/0x200 mm/util.c:506 > ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Freed by task 9992: > kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 > kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 > kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 > __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 > __cache_free mm/slab.c:3418 [inline] > kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693 > remove_vma+0x132/0x170 mm/mmap.c:184 > remove_vma_list mm/mmap.c:2613 [inline] > __do_munmap+0x743/0x1170 mm/mmap.c:2869 > do_munmap mm/mmap.c:2877 [inline] > mmap_region+0x257/0x1780 mm/mmap.c:1716 > do_mmap+0xcf9/0x11d0 mm/mmap.c:1545 > vm_mmap_pgoff+0x195/0x200 mm/util.c:506 > ksys_mmap_pgoff+0x43a/0x560 mm/mmap.c:1596 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > It is because vma is accessed after releasing mmap_sem, but someone else > acquired the mmap_sem and the vma is gone. > > Releasing mmap_sem after accessing vma should fix the problem. > > Fixes: 692fe62433d4c ("mm: Handle MADV_WILLNEED through vfs_fadvise()") > Reported-by: syzbot+b90df26038d1d5d85c97@syzkaller.appspotmail.com > Cc: Jan Kara > Cc: v5.4+ > Signed-off-by: Yang Shi > --- > mm/madvise.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/mm/madvise.c b/mm/madvise.c > index dd1d43cf026d..d4aa5f776543 100644 > --- a/mm/madvise.c > +++ b/mm/madvise.c > @@ -289,9 +289,9 @@ static long madvise_willneed(struct vm_area_struct *vma, > */ > *prev = NULL; /* tell sys_madvise we drop mmap_lock */ > get_file(file); > - mmap_read_unlock(current->mm); > offset = (loff_t)(start - vma->vm_start) > + ((loff_t)vma->vm_pgoff << PAGE_SHIFT); > + mmap_read_unlock(current->mm); > vfs_fadvise(file, offset, end - start, POSIX_FADV_WILLNEED); > fput(file); > mmap_read_lock(current->mm); > Late to the party, nice finding and fix Reviewed-by: David Hildenbrand -- Thanks, David / dhildenb