releases/4.19.34/mm-mempolicy-fix-uninit-memory-access.patch

   1 From 8cfb33948af6d7e7d48928ca9b063f72b999b152 Mon Sep 17 00:00:00 2001
   2 From: Vlastimil Babka <vbabka@suse.cz>
   3 Date: Tue, 5 Mar 2019 15:46:50 -0800
   4 Subject: mm, mempolicy: fix uninit memory access
   5
   6 [ Upstream commit 2e25644e8da4ed3a27e7b8315aaae74660be72dc ]
   7
   8 Syzbot with KMSAN reports (excerpt):
   9
  10 ==================================================================
  11 BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:353 [inline]
  12 BUG: KMSAN: uninit-value in mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384
  13 CPU: 1 PID: 17420 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #15
  14 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
  15 Google 01/01/2011
  16 Call Trace:
  17   __dump_stack lib/dump_stack.c:77 [inline]
  18   dump_stack+0x173/0x1d0 lib/dump_stack.c:113
  19   kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
  20   __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:295
  21   mpol_rebind_policy mm/mempolicy.c:353 [inline]
  22   mpol_rebind_mm+0x249/0x370 mm/mempolicy.c:384
  23   update_tasks_nodemask+0x608/0xca0 kernel/cgroup/cpuset.c:1120
  24   update_nodemasks_hier kernel/cgroup/cpuset.c:1185 [inline]
  25   update_nodemask kernel/cgroup/cpuset.c:1253 [inline]
  26   cpuset_write_resmask+0x2a98/0x34b0 kernel/cgroup/cpuset.c:1728
  27
  28 ...
  29
  30 Uninit was created at:
  31   kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline]
  32   kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158
  33   kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176
  34   kmem_cache_alloc+0x572/0xb90 mm/slub.c:2777
  35   mpol_new mm/mempolicy.c:276 [inline]
  36   do_mbind mm/mempolicy.c:1180 [inline]
  37   kernel_mbind+0x8a7/0x31a0 mm/mempolicy.c:1347
  38   __do_sys_mbind mm/mempolicy.c:1354 [inline]
  39
  40 As it's difficult to report where exactly the uninit value resides in
  41 the mempolicy object, we have to guess a bit.  mm/mempolicy.c:353
  42 contains this part of mpol_rebind_policy():
  43
  44         if (!mpol_store_user_nodemask(pol) &&
  45             nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
  46
  47 "mpol_store_user_nodemask(pol)" is testing pol->flags, which I couldn't
  48 ever see being uninitialized after leaving mpol_new().  So I'll guess
  49 it's actually about accessing pol->w.cpuset_mems_allowed on line 354,
  50 but still part of statement starting on line 353.
  51
  52 For w.cpuset_mems_allowed to be not initialized, and the nodes_equal()
  53 reachable for a mempolicy where mpol_set_nodemask() is called in
  54 do_mbind(), it seems the only possibility is a MPOL_PREFERRED policy
  55 with empty set of nodes, i.e.  MPOL_LOCAL equivalent, with MPOL_F_LOCAL
  56 flag.  Let's exclude such policies from the nodes_equal() check.  Note
  57 the uninit access should be benign anyway, as rebinding this kind of
  58 policy is always a no-op.  Therefore no actual need for stable
  59 inclusion.
  60
  61 Link: http://lkml.kernel.org/r/a71997c3-e8ae-a787-d5ce-3db05768b27c@suse.cz
  62 Link: http://lkml.kernel.org/r/73da3e9c-cc84-509e-17d9-0c434bb9967d@suse.cz
  63 Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
  64 Reported-by: syzbot+b19c2dc2c990ea657a71@syzkaller.appspotmail.com
  65 Cc: Alexander Potapenko <glider@google.com>
  66 Cc: Dmitry Vyukov <dvyukov@google.com>
  67 Cc: Andrea Arcangeli <aarcange@redhat.com>
  68 Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
  69 Cc: Michal Hocko <mhocko@suse.com>
  70 Cc: David Rientjes <rientjes@google.com>
  71 Cc: Yisheng Xie <xieyisheng1@huawei.com>
  72 Cc: zhong jiang <zhongjiang@huawei.com>
  73 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  74 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  75 Signed-off-by: Sasha Levin <sashal@kernel.org>
  76 ---
  77  mm/mempolicy.c | 2 +-
  78  1 file changed, 1 insertion(+), 1 deletion(-)
  79
  80 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
  81 index f32d0a5be4fb..360b24bc69e5 100644
  82 --- a/mm/mempolicy.c
  83 +++ b/mm/mempolicy.c
  84 @@ -350,7 +350,7 @@ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *newmask)
  85  {
  86         if (!pol)
  87                 return;
  88 -       if (!mpol_store_user_nodemask(pol) &&
  89 +       if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) &&
  90             nodes_equal(pol->w.cpuset_mems_allowed, *newmask))
  91                 return;
  92
  93 --
  94 2.19.1
  95