From: Mike Rapoport <rppt@linux.ibm.com>
To: zhong jiang <zhongjiang@huawei.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>,
Dmitry Vyukov <dvyukov@google.com>,
syzbot <syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com>,
Michal Hocko <mhocko@kernel.org>,
cgroups@vger.kernel.org, Johannes Weiner <hannes@cmpxchg.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>,
syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
Vladimir Davydov <vdavydov.dev@gmail.com>,
David Rientjes <rientjes@google.com>,
Hugh Dickins <hughd@google.com>,
Matthew Wilcox <willy@infradead.org>,
Mel Gorman <mgorman@suse.de>, Vlastimil Babka <vbabka@suse.cz>,
Mike Rapoport <rppt@linux.vnet.ibm.com>,
Peter Xu <peterx@redhat.com>
Subject: Re: KASAN: use-after-free Read in get_mem_cgroup_from_mm
Date: Wed, 6 Mar 2019 08:26:25 +0200 [thread overview]
Message-ID: <20190306062625.GA3549@rapoport-lnx> (raw)
In-Reply-To: <5C7F6048.2050802@huawei.com>
Hi,
On Wed, Mar 06, 2019 at 01:53:12PM +0800, zhong jiang wrote:
> On 2019/3/6 10:05, Andrea Arcangeli wrote:
> > Hello everyone,
> >
> > [ CC'ed Mike and Peter ]
> >
> > On Tue, Mar 05, 2019 at 02:42:00PM +0800, zhong jiang wrote:
> >> On 2019/3/5 14:26, Dmitry Vyukov wrote:
> >>> On Mon, Mar 4, 2019 at 4:32 PM zhong jiang <zhongjiang@huawei.com> wrote:
> >>>> On 2019/3/4 22:11, Dmitry Vyukov wrote:
> >>>>> On Mon, Mar 4, 2019 at 3:00 PM zhong jiang <zhongjiang@huawei.com> wrote:
> >>>>>> On 2019/3/4 15:40, Dmitry Vyukov wrote:
> >>>>>>> On Sun, Mar 3, 2019 at 5:19 PM zhong jiang <zhongjiang@huawei.com> wrote:
> >>>>>>>> Hi, guys
> >>>>>>>>
> >>>>>>>> I also hit the following issue. but it fails to reproduce the issue by the log.
> >>>>>>>>
> >>>>>>>> it seems to the case that we access the mm->owner and deference it will result in the UAF.
> >>>>>>>> But it should not be possible that we specify the incomplete process to be the mm->owner.
> >>>>>>>>
> >>>>>>>> Any thoughts?
> >>>>>>> FWIW syzbot was able to reproduce this with this reproducer.
> >>>>>>> This looks like a very subtle race (threaded reproducer that runs
> >>>>>>> repeatedly in multiple processes), so most likely we are looking for
> >>>>>>> something like few instructions inconsistency window.
> >>>>>>>
> >>>>>> I has a little doubtful about the instrustions inconsistency window.
> >>>>>>
> >>>>>> I guess that you mean some smb barriers should be taken into account.:-)
> >>>>>>
> >>>>>> Because IMO, It should not be the lock case to result in the issue.
> >>>>> Since the crash was triggered on x86 _most likley_ this is not a
> >>>>> missed barrier. What I meant is that one thread needs to executed some
> >>>>> code, while another thread is stopped within few instructions.
> >>>>>
> >>>>>
> >>>> It is weird and I can not find any relationship you had said with the issue.:-(
> >>>>
> >>>> Because It is the cause that mm->owner has been freed, whereas we still deference it.
> >>>>
> >>>> From the lastest freed task call trace, It fails to create process.
> >>>>
> >>>> Am I miss something or I misunderstand your meaning. Please correct me.
> >>> Your analysis looks correct. I am just saying that the root cause of
> >>> this use-after-free seems to be a race condition.
> >>>
> >>>
> >>>
> >> Yep, Indeed, I can not figure out how the race works. I will dig up further.
> > Yes it's a race condition.
> >
> > We were aware about the non-cooperative fork userfaultfd feature
> > creating userfaultfd file descriptor that gets reported to the parent
> > uffd, despite they belong to mm created by failed forks.
> >
> > https://www.spinics.net/lists/linux-mm/msg136357.html
> >
>
> Hi, Andrea
>
> I still not clear why uffd ioctl can use the incomplete process as the mm->owner.
> and how to produce the race.
There is a C reproducer in the syzcaller report:
https://syzkaller.appspot.com/x/repro.c?x=172fa5a3400000
> From your above explainations, My underdtanding is that the process handling do_exexve
> will have a temporary mm, which will be used by the UUFD ioctl.
The race is between userfaultfd operation and fork() failure:
forking thread | userfaultfd monitor thread
--------------------------------+-------------------------------
fork() |
dup_mmap() |
dup_userfaultfd() |
dup_userfaultfd_complete() |
| read(UFFD_EVENT_FORK)
| uffdio_copy()
| mmget_not_zero()
goto bad_fork_something |
... |
bad_fork_free: |
free_task() |
| mem_cgroup_from_task()
| /* access stale mm->owner */
> Thanks,
> zhong jiang
--
Sincerely yours,
Mike.
next prev parent reply other threads:[~2019-03-06 6:26 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-07 1:52 KASAN: use-after-free Read in get_mem_cgroup_from_mm syzbot
2018-12-04 15:43 ` syzbot
2019-03-03 16:19 ` zhong jiang
2019-03-04 7:40 ` Dmitry Vyukov
2019-03-04 14:00 ` zhong jiang
2019-03-04 14:11 ` Dmitry Vyukov
2019-03-04 15:32 ` zhong jiang
2019-03-05 6:26 ` Dmitry Vyukov
2019-03-05 6:42 ` zhong jiang
2019-03-06 2:05 ` Andrea Arcangeli
2019-03-06 5:53 ` zhong jiang
2019-03-06 6:26 ` Mike Rapoport [this message]
2019-03-06 7:41 ` zhong jiang
2019-03-06 8:12 ` Peter Xu
2019-03-06 13:07 ` zhong jiang
2019-03-06 18:29 ` Andrea Arcangeli
2019-03-07 7:58 ` zhong jiang
2019-03-06 8:20 ` Mike Rapoport
2019-03-08 7:10 ` zhong jiang
2019-03-15 21:39 ` Andrea Arcangeli
2019-03-16 9:38 ` zhong jiang
2019-03-16 19:42 ` Andrea Arcangeli
2019-03-18 6:23 ` zhong jiang
2019-03-04 21:51 ` Matthew Wilcox
2019-03-05 3:09 ` zhong jiang
2019-03-22 9:36 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190306062625.GA3549@rapoport-lnx \
--to=rppt@linux.ibm.com \
--cc=aarcange@redhat.com \
--cc=cgroups@vger.kernel.org \
--cc=dvyukov@google.com \
--cc=hannes@cmpxchg.org \
--cc=hughd@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mgorman@suse.de \
--cc=mhocko@kernel.org \
--cc=peterx@redhat.com \
--cc=rientjes@google.com \
--cc=rppt@linux.vnet.ibm.com \
--cc=syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=vbabka@suse.cz \
--cc=vdavydov.dev@gmail.com \
--cc=willy@infradead.org \
--cc=zhongjiang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).