From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D16DFC4332F for ; Tue, 13 Dec 2022 12:54:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235245AbiLMMyT (ORCPT ); Tue, 13 Dec 2022 07:54:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234798AbiLMMyQ (ORCPT ); Tue, 13 Dec 2022 07:54:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 120DBCE04; Tue, 13 Dec 2022 04:54:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2155B8118D; Tue, 13 Dec 2022 12:54:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF39AC433D2; Tue, 13 Dec 2022 12:54:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1670936052; bh=a9N4mnDaTBWCBW0Yxm5TccjiatRz/8qHS67WBG5oYaQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=eockNV7+fQ+JdLOO5+69dcrpzLiBOahjCuIVYVggbXUsqs4LrLxOeWgozJmb7WRJ1 9/U5WvcXZlYrx5UDpr/XPC6eHvnIyHRCPXpF0Nppmn8lqrhMNdxf6yxB32/zi1rso6 rMZWlH7mAa68z4LmTcH17yMGY/o0kIo2jJ8zx4JubQKm+1RsoUmCAeb3flGVR+LlWC JNPYUQcT2e//ae0OhFyBjSe2ozKo77l/IXf/wYgN4xe63wqwzmMfuBGDdFN1BCLOwK mDOjalerc7wfJJoMIu1p/RziAM8PEjMKzGhTlc5MxcNLfd+yKT0EvTx2ehfksOq5iW Lku09e7jhsAbQ== Date: Tue, 13 Dec 2022 12:54:05 +0000 From: Will Deacon To: Waiman Long Cc: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Phil Auld , Wenjie Li , David Wang =?utf-8?B?546L5qCH?= , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH-tip] sched: Fix use-after-free bug in dup_user_cpus_ptr() Message-ID: <20221213125404.GD5719@willie-the-truck> References: <20221128014441.1264867-1-longman@redhat.com> <20221201134445.GC28489@willie-the-truck> <330989bf-0015-6d4c-9317-bfc9dba30b65@redhat.com> <20221202101835.GA29522@willie-the-truck> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Dec 02, 2022 at 09:30:56AM -0500, Waiman Long wrote: > On 12/2/22 05:18, Will Deacon wrote: > > On Thu, Dec 01, 2022 at 12:03:39PM -0500, Waiman Long wrote: > > > On 12/1/22 08:44, Will Deacon wrote: > > > > On Sun, Nov 27, 2022 at 08:44:41PM -0500, Waiman Long wrote: > > > > > Since commit 07ec77a1d4e8 ("sched: Allow task CPU affinity to be > > > > > restricted on asymmetric systems"), the setting and clearing of > > > > > user_cpus_ptr are done under pi_lock for arm64 architecture. However, > > > > > dup_user_cpus_ptr() accesses user_cpus_ptr without any lock > > > > > protection. When racing with the clearing of user_cpus_ptr in > > > > > __set_cpus_allowed_ptr_locked(), it can lead to user-after-free and > > > > > double-free in arm64 kernel. > > > > > > > > > > Commit 8f9ea86fdf99 ("sched: Always preserve the user requested > > > > > cpumask") fixes this problem as user_cpus_ptr, once set, will never > > > > > be cleared in a task's lifetime. However, this bug was re-introduced > > > > > in commit 851a723e45d1 ("sched: Always clear user_cpus_ptr in > > > > > do_set_cpus_allowed()") which allows the clearing of user_cpus_ptr in > > > > > do_set_cpus_allowed(). This time, it will affect all arches. > > > > > > > > > > Fix this bug by always clearing the user_cpus_ptr of the newly > > > > > cloned/forked task before the copying process starts and check the > > > > > user_cpus_ptr state of the source task under pi_lock. > > > > > > > > > > Note to stable, this patch won't be applicable to stable releases. > > > > > Just copy the new dup_user_cpus_ptr() function over. > > > > > > > > > > Fixes: 07ec77a1d4e8 ("sched: Allow task CPU affinity to be restricted on asymmetric systems") > > > > > Fixes: 851a723e45d1 ("sched: Always clear user_cpus_ptr in do_set_cpus_allowed()") > > > > > CC: stable@vger.kernel.org > > > > > Reported-by: David Wang 王标 > > > > > Signed-off-by: Waiman Long > > > > > --- > > > > > kernel/sched/core.c | 32 ++++++++++++++++++++++++++++---- > > > > > 1 file changed, 28 insertions(+), 4 deletions(-) > > > > As per my comments on the previous version of this patch: > > > > > > > > https://lore.kernel.org/lkml/20221201133602.GB28489@willie-the-truck/T/#t > > > > > > > > I think there are other issues to fix when racing affinity changes with > > > > fork() too. > > > It is certainly possible that there are other bugs hiding somewhere:-) > > Right, but I actually took the time to hit the same race for the other > > affinity mask field so it seems a bit narrow-minded for us just to fix the > > one issue. > > I focused on this particular one because of a double-free bug report from > David. What other fields have you found to be subjected to data race? See my other report linked above where we race on 'task_struct::cpus_mask'. Will