* [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0
@ 2021-03-10 12:37 Filippo Sironi
2021-03-10 15:57 ` Jens Axboe
2021-03-10 17:09 ` Eric W. Biederman
0 siblings, 2 replies; 3+ messages in thread
From: Filippo Sironi @ 2021-03-10 12:37 UTC (permalink / raw)
To: linux-kernel
Cc: dwmw, christian.brauner, akpm, ebiederm, peterz, keescook,
krisman, peterx, axboe, surenb, shakeelb, guro, elver,
Filippo Sironi
We've seen a number of crashes with the following signature:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
...
Oops: 0000 [#1] SMP PTI
...
RIP: 0010:__rb_erase_color+0xc2/0x260
...
Call Trace:
unlink_file_vma+0x36/0x50
free_pgtables+0x62/0x110
exit_mmap+0xd5/0x160
? put_dec+0x3a/0x90
? num_to_str+0xa8/0xc0
mmput+0x11/0xb0
do_task_stat+0x940/0xc80
proc_single_show+0x49/0x80
? __check_object_size+0xcc/0x1a0
seq_read+0xd3/0x400
vfs_read+0x72/0xb0
ksys_read+0x9c/0xd0
do_syscall_64+0x69/0x400
? schedule+0x2a/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xa9
...
This happens when a process goes through the tasks stats in procfs while
another is exiting. This looks like a race where the process that's
exiting drops the last reference on the mm (with mmput) while the other
increases it (with mmget). By only increasing when the reference isn't
0 to begin with, we prevent this from happening.
Signed-off-by: Filippo Sironi <sironi@amazon.de>
---
kernel/fork.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index d3171e8e88e5..a7541a85e5a9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1209,10 +1209,8 @@ struct mm_struct *get_task_mm(struct task_struct *task)
task_lock(task);
mm = task->mm;
if (mm) {
- if (task->flags & PF_KTHREAD)
+ if (task->flags & PF_KTHREAD || !mmget_not_zero(mm))
mm = NULL;
- else
- mmget(mm);
}
task_unlock(task);
return mm;
--
2.17.1
Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0
2021-03-10 12:37 [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0 Filippo Sironi
@ 2021-03-10 15:57 ` Jens Axboe
2021-03-10 17:09 ` Eric W. Biederman
1 sibling, 0 replies; 3+ messages in thread
From: Jens Axboe @ 2021-03-10 15:57 UTC (permalink / raw)
To: Filippo Sironi, linux-kernel
Cc: dwmw, christian.brauner, akpm, ebiederm, peterz, keescook,
krisman, peterx, surenb, shakeelb, guro, elver
On 3/10/21 5:37 AM, Filippo Sironi wrote:
> We've seen a number of crashes with the following signature:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> ...
> Oops: 0000 [#1] SMP PTI
> ...
> RIP: 0010:__rb_erase_color+0xc2/0x260
> ...
> Call Trace:
> unlink_file_vma+0x36/0x50
> free_pgtables+0x62/0x110
> exit_mmap+0xd5/0x160
> ? put_dec+0x3a/0x90
> ? num_to_str+0xa8/0xc0
> mmput+0x11/0xb0
> do_task_stat+0x940/0xc80
> proc_single_show+0x49/0x80
> ? __check_object_size+0xcc/0x1a0
> seq_read+0xd3/0x400
> vfs_read+0x72/0xb0
> ksys_read+0x9c/0xd0
> do_syscall_64+0x69/0x400
> ? schedule+0x2a/0x90
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> ...
>
> This happens when a process goes through the tasks stats in procfs while
> another is exiting. This looks like a race where the process that's
> exiting drops the last reference on the mm (with mmput) while the other
> increases it (with mmget). By only increasing when the reference isn't
> 0 to begin with, we prevent this from happening.
From a quick look it looks reasonable, but I don't quite see how we get
in the situation of finding a valid ->mm under task_lock() and the
mm_users count being 0? I'd like to understand that, because it may just
be that your patch just narrows the gap but it's still possible to
trigger a use-after-free. Doesn't seem like that would be possible under
exit_mm().
--
Jens Axboe
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0
2021-03-10 12:37 [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0 Filippo Sironi
2021-03-10 15:57 ` Jens Axboe
@ 2021-03-10 17:09 ` Eric W. Biederman
1 sibling, 0 replies; 3+ messages in thread
From: Eric W. Biederman @ 2021-03-10 17:09 UTC (permalink / raw)
To: Filippo Sironi
Cc: linux-kernel, dwmw, christian.brauner, akpm, peterz, keescook,
krisman, peterx, axboe, surenb, shakeelb, guro, elver
Filippo Sironi <sironi@amazon.de> writes:
> We've seen a number of crashes with the following signature:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> ...
> Oops: 0000 [#1] SMP PTI
> ...
> RIP: 0010:__rb_erase_color+0xc2/0x260
> ...
> Call Trace:
> unlink_file_vma+0x36/0x50
> free_pgtables+0x62/0x110
> exit_mmap+0xd5/0x160
> ? put_dec+0x3a/0x90
> ? num_to_str+0xa8/0xc0
> mmput+0x11/0xb0
> do_task_stat+0x940/0xc80
> proc_single_show+0x49/0x80
> ? __check_object_size+0xcc/0x1a0
> seq_read+0xd3/0x400
> vfs_read+0x72/0xb0
> ksys_read+0x9c/0xd0
> do_syscall_64+0x69/0x400
> ? schedule+0x2a/0x90
> entry_SYSCALL_64_after_hwframe+0x44/0xa9
> ...
>
> This happens when a process goes through the tasks stats in procfs while
> another is exiting. This looks like a race where the process that's
> exiting drops the last reference on the mm (with mmput) while the other
> increases it (with mmget). By only increasing when the reference isn't
> 0 to begin with, we prevent this from happening.
For this to be a race with exit this would require racing with exit_mm
where current->mm is cleared.
Looking at exit_mm() the code does:
struct mm_struct *mm = current->mm;
mmap_read_lock(mm);
mmgrab(mm);
task_lock(current);
local_irq_disable();
current->mm = NULL;
local_irq_enable();
task_unlock(current);
mmap_read_unlock(mm);
mmput(mm);
Which seems to guarantee "mm_users > 0" if "task->mm != NULL" under
tasklist_lock.
So I suggest you instrument your failing kernels and find what is
improperly decrementing mm_users.
Eric
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-03-10 17:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-10 12:37 [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0 Filippo Sironi
2021-03-10 15:57 ` Jens Axboe
2021-03-10 17:09 ` Eric W. Biederman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).