From: "Michal Koutný" <mkoutny@suse.com>
To: mkoutny@suse.com
Cc: gorcunov@gmail.com, ktkhai@virtuozzo.com, ldufour@linux.ibm.com,
Matthew Wilcox <willy@infradead.org>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org
Subject: [RFC PATCH v2] binfmt_elf: Protect mm_struct access with mmap_sem
Date: Thu, 13 Jun 2019 12:47:15 +0200 [thread overview]
Message-ID: <20190613104715.22367-1-mkoutny@suse.com> (raw)
In-Reply-To: <20190612142811.24894-1-mkoutny@suse.com>
find_extend_vma assumes the caller holds mmap_sem as a reader (explained
in expand_downwards()). The path when we are extending the stack VMA to
accommodate argv[] pointers happens without the lock.
I was not able to cause an mm_struct corruption but an inserted
BUG_ON(!rwsem_is_locked(&mm->mmap_sem)) in find_extend_vma could be
triggered as
# <bigfile xargs echo
xargs: echo: terminated by signal 11
(bigfile needs to have more than RLIMIT_STACK / sizeof(char *) rows)
Other accesses to mm_struct in exec path are protected by mmap_sem, so
conservatively, protect also this one.
Besides that, explain in comments why we omit mm_struct.arg_lock in the
exec(2) path and drop an obsolete comment about removed passed_fileno.
v2: Updated changelog
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
Signed-off-by: Michal Koutný <mkoutny@suse.com>
---
fs/binfmt_elf.c | 10 +++++++++-
fs/exec.c | 3 ++-
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 8264b468f283..48e169760a9c 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -299,7 +299,11 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
* Grow the stack manually; some architectures have a limit on how
* far ahead a user-space access may be in order to grow the stack.
*/
+ if (down_read_killable(¤t->mm->mmap_sem))
+ return -EINTR;
vma = find_extend_vma(current->mm, bprm->p);
+ up_read(¤t->mm->mmap_sem);
+
if (!vma)
return -EFAULT;
@@ -1123,11 +1127,15 @@ static int load_elf_binary(struct linux_binprm *bprm)
goto out;
#endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
+ /*
+ * Don't take mm->arg_lock. The concurrent change might happen only
+ * from prctl_set_mm but after de_thread we are certainly alone here.
+ */
retval = create_elf_tables(bprm, &loc->elf_ex,
load_addr, interp_load_addr);
if (retval < 0)
goto out;
- /* N.B. passed_fileno might not be initialized? */
+
current->mm->end_code = end_code;
current->mm->start_code = start_code;
current->mm->start_data = start_data;
diff --git a/fs/exec.c b/fs/exec.c
index 89a500bb897a..d5b55c92019a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -212,7 +212,8 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos,
/*
* We are doing an exec(). 'current' is the process
- * doing the exec and bprm->mm is the new process's mm.
+ * doing the exec and bprm->mm is the new process's mm that is not
+ * shared yet, so no synchronization on mmap_sem.
*/
ret = get_user_pages_remote(current, bprm->mm, pos, 1, gup_flags,
&page, NULL, NULL);
--
2.21.0
prev parent reply other threads:[~2019-06-13 15:32 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-12 14:28 [RFC PATCH] binfmt_elf: Protect mm_struct access with mmap_sem Michal Koutný
2019-06-12 17:00 ` Matthew Wilcox
2019-06-12 17:29 ` Michal Koutný
2019-06-12 17:51 ` Matthew Wilcox
2019-06-12 18:04 ` Cyrill Gorcunov
2019-06-12 18:02 ` Cyrill Gorcunov
2019-06-13 10:47 ` Michal Koutný [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190613104715.22367-1-mkoutny@suse.com \
--to=mkoutny@suse.com \
--cc=gorcunov@gmail.com \
--cc=ktkhai@virtuozzo.com \
--cc=ldufour@linux.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).