From: Greg Kroah-Hartman Date: Wed, 25 Nov 2020 11:57:49 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.4.247~46 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=61d381983ec30227ac7688f7088d1cf946fd7883;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: mm-userfaultfd-do-not-access-vma-vm_mm-after-calling-handle_userfault.patch --- diff --git a/queue-4.14/mm-userfaultfd-do-not-access-vma-vm_mm-after-calling-handle_userfault.patch b/queue-4.14/mm-userfaultfd-do-not-access-vma-vm_mm-after-calling-handle_userfault.patch new file mode 100644 index 00000000000..07437c90d1a --- /dev/null +++ b/queue-4.14/mm-userfaultfd-do-not-access-vma-vm_mm-after-calling-handle_userfault.patch @@ -0,0 +1,168 @@ +From foo@baz Wed Nov 25 12:55:54 PM CET 2020 +From: Gerald Schaefer +Date: Mon, 23 Nov 2020 17:52:58 +0100 +Subject: mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() +To: , Greg Kroah-Hartman +Cc: Andrea Arcangeli , Andrew Morton , Alexander Egorenkov , Heiko Carstens +Message-ID: <20201123165258.80810-1-gerald.schaefer@linux.ibm.com> + +From: Gerald Schaefer + +commit bfe8cc1db02ab243c62780f17fc57f65bde0afe1 upstream. + +Alexander reported a syzkaller / KASAN finding on s390, see below for +complete output. + +In do_huge_pmd_anonymous_page(), the pre-allocated pagetable will be +freed in some cases. In the case of userfaultfd_missing(), this will +happen after calling handle_userfault(), which might have released the +mmap_lock. Therefore, the following pte_free(vma->vm_mm, pgtable) will +access an unstable vma->vm_mm, which could have been freed or re-used +already. + +For all architectures other than s390 this will go w/o any negative +impact, because pte_free() simply frees the page and ignores the +passed-in mm. The implementation for SPARC32 would also access +mm->page_table_lock for pte_free(), but there is no THP support in +SPARC32, so the buggy code path will not be used there. + +For s390, the mm->context.pgtable_list is being used to maintain the 2K +pagetable fragments, and operating on an already freed or even re-used +mm could result in various more or less subtle bugs due to list / +pagetable corruption. + +Fix this by calling pte_free() before handle_userfault(), similar to how +it is already done in __do_huge_pmd_anonymous_page() for the WRITE / +non-huge_zero_page case. + +Commit 6b251fc96cf2c ("userfaultfd: call handle_userfault() for +userfaultfd_missing() faults") actually introduced both, the +do_huge_pmd_anonymous_page() and also __do_huge_pmd_anonymous_page() +changes wrt to calling handle_userfault(), but only in the latter case +it put the pte_free() before calling handle_userfault(). + + BUG: KASAN: use-after-free in do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744 + Read of size 8 at addr 00000000962d6988 by task syz-executor.0/9334 + + CPU: 1 PID: 9334 Comm: syz-executor.0 Not tainted 5.10.0-rc1-syzkaller-07083-g4c9720875573 #0 + Hardware name: IBM 3906 M04 701 (KVM/Linux) + Call Trace: + do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744 + create_huge_pmd mm/memory.c:4256 [inline] + __handle_mm_fault+0xe6e/0x1068 mm/memory.c:4480 + handle_mm_fault+0x288/0x748 mm/memory.c:4607 + do_exception+0x394/0xae0 arch/s390/mm/fault.c:479 + do_dat_exception+0x34/0x80 arch/s390/mm/fault.c:567 + pgm_check_handler+0x1da/0x22c arch/s390/kernel/entry.S:706 + copy_from_user_mvcos arch/s390/lib/uaccess.c:111 [inline] + raw_copy_from_user+0x3a/0x88 arch/s390/lib/uaccess.c:174 + _copy_from_user+0x48/0xa8 lib/usercopy.c:16 + copy_from_user include/linux/uaccess.h:192 [inline] + __do_sys_sigaltstack kernel/signal.c:4064 [inline] + __s390x_sys_sigaltstack+0xc8/0x240 kernel/signal.c:4060 + system_call+0xe0/0x28c arch/s390/kernel/entry.S:415 + + Allocated by task 9334: + slab_alloc_node mm/slub.c:2891 [inline] + slab_alloc mm/slub.c:2899 [inline] + kmem_cache_alloc+0x118/0x348 mm/slub.c:2904 + vm_area_dup+0x9c/0x2b8 kernel/fork.c:356 + __split_vma+0xba/0x560 mm/mmap.c:2742 + split_vma+0xca/0x108 mm/mmap.c:2800 + mlock_fixup+0x4ae/0x600 mm/mlock.c:550 + apply_vma_lock_flags+0x2c6/0x398 mm/mlock.c:619 + do_mlock+0x1aa/0x718 mm/mlock.c:711 + __do_sys_mlock2 mm/mlock.c:738 [inline] + __s390x_sys_mlock2+0x86/0xa8 mm/mlock.c:728 + system_call+0xe0/0x28c arch/s390/kernel/entry.S:415 + + Freed by task 9333: + slab_free mm/slub.c:3142 [inline] + kmem_cache_free+0x7c/0x4b8 mm/slub.c:3158 + __vma_adjust+0x7b2/0x2508 mm/mmap.c:960 + vma_merge+0x87e/0xce0 mm/mmap.c:1209 + userfaultfd_release+0x412/0x6b8 fs/userfaultfd.c:868 + __fput+0x22c/0x7a8 fs/file_table.c:281 + task_work_run+0x200/0x320 kernel/task_work.c:151 + tracehook_notify_resume include/linux/tracehook.h:188 [inline] + do_notify_resume+0x100/0x148 arch/s390/kernel/signal.c:538 + system_call+0xe6/0x28c arch/s390/kernel/entry.S:416 + + The buggy address belongs to the object at 00000000962d6948 which belongs to the cache vm_area_struct of size 200 + The buggy address is located 64 bytes inside of 200-byte region [00000000962d6948, 00000000962d6a10) + The buggy address belongs to the page: page:00000000313a09fe refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x962d6 flags: 0x3ffff00000000200(slab) + raw: 3ffff00000000200 000040000257e080 0000000c0000000c 000000008020ba00 + raw: 0000000000000000 000f001e00000000 ffffffff00000001 0000000096959501 + page dumped because: kasan: bad access detected + page->mem_cgroup:0000000096959501 + + Memory state around the buggy address: + 00000000962d6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 00000000962d6900: 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb + >00000000962d6980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + 00000000962d6a00: fb fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00 + 00000000962d6a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ================================================================== + +Changes for v4.14 stable: + - Make it apply w/o + * Commit 4cf58924951ef ("mm: treewide: remove unused address argument + from pte_alloc functions") + * Commit 2b7403035459c ("mm: Change return type int to vm_fault_t for + fault handlers") + +Fixes: 6b251fc96cf2c ("userfaultfd: call handle_userfault() for userfaultfd_missing() faults") +Reported-by: Alexander Egorenkov +Signed-off-by: Gerald Schaefer +Signed-off-by: Andrew Morton +Cc: Andrea Arcangeli +Cc: Heiko Carstens +Cc: [4.3+] +Link: https://lkml.kernel.org/r/20201110190329.11920-1-gerald.schaefer@linux.ibm.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/huge_memory.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -688,7 +688,6 @@ int do_huge_pmd_anonymous_page(struct vm + transparent_hugepage_use_zero_page()) { + pgtable_t pgtable; + struct page *zero_page; +- bool set; + int ret; + pgtable = pte_alloc_one(vma->vm_mm, haddr); + if (unlikely(!pgtable)) +@@ -701,25 +700,25 @@ int do_huge_pmd_anonymous_page(struct vm + } + vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd); + ret = 0; +- set = false; + if (pmd_none(*vmf->pmd)) { + ret = check_stable_address_space(vma->vm_mm); + if (ret) { + spin_unlock(vmf->ptl); ++ pte_free(vma->vm_mm, pgtable); + } else if (userfaultfd_missing(vma)) { + spin_unlock(vmf->ptl); ++ pte_free(vma->vm_mm, pgtable); + ret = handle_userfault(vmf, VM_UFFD_MISSING); + VM_BUG_ON(ret & VM_FAULT_FALLBACK); + } else { + set_huge_zero_page(pgtable, vma->vm_mm, vma, + haddr, vmf->pmd, zero_page); + spin_unlock(vmf->ptl); +- set = true; + } +- } else ++ } else { + spin_unlock(vmf->ptl); +- if (!set) + pte_free(vma->vm_mm, pgtable); ++ } + return ret; + } + gfp = alloc_hugepage_direct_gfpmask(vma); diff --git a/queue-4.14/series b/queue-4.14/series index 3cad090402b..8dc2bb307fe 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -1 +1,2 @@ perf-event-check-ref_reloc_sym-before-using-it.patch +mm-userfaultfd-do-not-access-vma-vm_mm-after-calling-handle_userfault.patch