From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0972C433EF for ; Tue, 15 Feb 2022 20:46:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2CB8E6B0078; Tue, 15 Feb 2022 15:46:00 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 27C406B007B; Tue, 15 Feb 2022 15:46:00 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 11C5E6B007D; Tue, 15 Feb 2022 15:46:00 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.26]) by kanga.kvack.org (Postfix) with ESMTP id 03F536B0078 for ; Tue, 15 Feb 2022 15:46:00 -0500 (EST) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id BBCAE234C7 for ; Tue, 15 Feb 2022 20:45:59 +0000 (UTC) X-FDA: 79146196038.03.EF9618B Received: from mail-yb1-f175.google.com (mail-yb1-f175.google.com [209.85.219.175]) by imf28.hostedemail.com (Postfix) with ESMTP id 51FB9C0006 for ; Tue, 15 Feb 2022 20:45:59 +0000 (UTC) Received: by mail-yb1-f175.google.com with SMTP id y129so59843601ybe.7 for ; Tue, 15 Feb 2022 12:45:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=DKFnfXICHV30cawWi7Dlo/LToBg+cBNwCh6pYOdTGf0=; b=Q4kKNhttlKkyigQfDHvw0u0oIrH6bETkjHPnYObQe8cfPACv/HYb1qa87/AfhartnC DRb5T45HVIZv9zWqyym+GKFwvpCSN2ZIlRo+8cOHfPBeDC+jh6HRyW7nC6/I3fljOHgI wkS0SZZtZCIZENF9Cuu9JlltisxzuGBDqtFGlDPD3C/QTiZWLOQHhC2I+2/isA0acInx N2IRKM8rp/dYdaGwO/bwVIwmvpjC+0ydnqX+XeHN7bmm+GGk3vd7pWxjSuw/hJC0N6aW 6exJkxIKZik3xAjiGQ7lnntLMNLLo3lKVjxNqhAGyZkIVJ3SP1ZDb0C+pqQNXufBehzE 5pSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=DKFnfXICHV30cawWi7Dlo/LToBg+cBNwCh6pYOdTGf0=; b=Ue0mlybYQ2GJkQKisVDHK1U3mzfZsvTn+KhdTOsR4aC0gMHNKeIswHx9VidlZJtJf0 WnLL9KhUXy5YBJlrKTSKnRovJcnmm0eDHGRGNbPWgH/UTVqnmPRzMU5LH0WM299/mn2O 9o0NEngJ0NG0RvBrXIndbsTbxv7GHPeBJYNIDS7f0hzrMJnUHz8qZVVSe/uB4nTEdZtG D/qw5zxB4b8SutpnCYtNi9nKHkBa7xwQbVUcyHL51tMgzCg6q36C+zCFWaXYERViPgDX fQ6QwsqLqoJ7CxJLrZjd9/x0+lqJ0p1pLIAN72+XATNVdhbG/3J3qn1jf6IbZNrsutZX cnAw== X-Gm-Message-State: AOAM530IGwpXl4gD2fdx0fifbKW0rqcgXJoK8srt7u8cjP0dbbo0as28 9eMVXj95mafeKOzPJkpwJixjfnMwEmdO3niC0LUnmA== X-Google-Smtp-Source: ABdhPJzUBEInBloOfWBh9K2xofyIht7SdZ1zeb9FbyAO1UXPE90Xf+F5r1PKJc90aQ6IQZvY+QkZd029SNUAKALrCnQ= X-Received: by 2002:a81:a4d3:: with SMTP id b202mr677950ywh.380.1644957958297; Tue, 15 Feb 2022 12:45:58 -0800 (PST) MIME-Version: 1.0 References: <20220215201922.1908156-1-surenb@google.com> <20220215123741.8e757b337e1f2d32a1766d42@linux-foundation.org> In-Reply-To: <20220215123741.8e757b337e1f2d32a1766d42@linux-foundation.org> From: Suren Baghdasaryan Date: Tue, 15 Feb 2022 12:45:47 -0800 Message-ID: Subject: Re: [PATCH 1/1] mm: fix use-after-free bug when mm->mmap is reused after being freed To: Andrew Morton Cc: Michal Hocko , Michal Hocko , Yang Shi , David Rientjes , Matthew Wilcox , Johannes Weiner , Roman Gushchin , Rik van Riel , Minchan Kim , "Kirill A. Shutemov" , Andrea Arcangeli , Christian Brauner , Christian Brauner , Christoph Hellwig , Oleg Nesterov , David Hildenbrand , Jann Horn , Shakeel Butt , Andy Lutomirski , Christian Brauner , Florian Weimer , Jan Engelhardt , Tim Murray , linux-mm , LKML , kernel-team , syzbot Content-Type: text/plain; charset="UTF-8" X-Stat-Signature: 8p1ttxbgcnyq61tmu4dq49jpinb3czib X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: 51FB9C0006 Authentication-Results: imf28.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=Q4kKNhtt; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf28.hostedemail.com: domain of surenb@google.com designates 209.85.219.175 as permitted sender) smtp.mailfrom=surenb@google.com X-Rspam-User: X-HE-Tag: 1644957959-754608 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Feb 15, 2022 at 12:37 PM Andrew Morton wrote: > > On Tue, 15 Feb 2022 12:19:22 -0800 Suren Baghdasaryan wrote: > > > After exit_mmap frees all vmas in the mm, mm->mmap needs to be reset, > > otherwise it points to a vma that was freed and when reused leads to > > a use-after-free bug. > > > > ... > > > > --- a/mm/mmap.c > > +++ b/mm/mmap.c > > @@ -3186,6 +3186,7 @@ void exit_mmap(struct mm_struct *mm) > > vma = remove_vma(vma); > > cond_resched(); > > } > > + mm->mmap = NULL; > > mmap_write_unlock(mm); > > vm_unacct_memory(nr_accounted); > > } > > https://lore.kernel.org/all/00000000000072ef2c05d7f81950@google.com/ > > It would be nice to have a Fixes: for this. Oh, right. Should be: Fixes: 64591e8605d6 ("mm: protect free_pgtables with mmap_lock write lock in exit_mmap") > > Is it specific to process_mrelease(), or should we backport further? The broken change is recent and was introduced in v5.17-rc1.