From patchwork Sat Oct 22 07:29:38 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 7687 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4242:0:0:0:0:0 with SMTP id s2csp1109058wrr; Sat, 22 Oct 2022 01:47:06 -0700 (PDT) X-Google-Smtp-Source: AMsMyM5HVf7huNM6VURrYbv0deeHquZMfF7jUjR9VwAV2IotyOyjJP5hGFSTXd8n6MLHHUsmJZGy X-Received: by 2002:a17:906:9b87:b0:733:1795:2855 with SMTP id dd7-20020a1709069b8700b0073317952855mr19219664ejc.156.1666428425967; Sat, 22 Oct 2022 01:47:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666428425; cv=none; d=google.com; s=arc-20160816; b=ttcMDOK8ackzLyq1x1lXI+yKOJz/D0wMda9tXDrC85AAXD148obJuPHHnk2EAJwqVa cC4XAGCfu/V5xnhMT6/RMVip6CXt9iwqqHGOdDSH4TtOGY0z00JQ/PYaNuQGO8XlcpPb hSNssOtP9iUoIegx10mrWBDMw6Fcn2aRJvMNuOcz5Vl+JnDjdzxCO2n52+vT0DWnsS6h SV4w2y7gPCfjaXzf7c10ilq1HEEVZz/+0tkhA6U5jXWfFVcgdBdIC0sHgviLRh3VFbI5 HBXVN6USbGzYRjW9u3Y8dsmvGgoaK7HFNokj0Imy5/z3zDKAa3CErrVTrjRZXL8zUTaq Tnbw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=twDjl41JmSYDehn3mM8tglfC07b9iurJOl8R2EzjmGo=; b=q7zD2ZR4oFX2wZeMmhN88yzThYoXMIeHOGmNybKW6Uat6rz3HoJMEw4gqNcTcZ9A9S Fa29lunHuA4IneDkU5n9E6xw3tl4FNzV4tffToD/Wuj6Wav4pLITuIhXU/XjlA4LXmpJ r/Q8AP+tDs72o1rpbuR4kHx6tWSpjZHfCgYLfFA76myFzd+9jUTyDKGDKHohHR9bJS5w f5szw8g9mhRM1DqrLqZ092NTM16++ksyvaUII8D0xotVi/ASd2M5uFniaDSy0NppWr54 PzFh3lfO+u7NgR9kzr5QOXaE/c0Eq821fqRCtDvPw3i8IfizdhCFskRmWgSIiOTqeHDI bbtA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kQJtik8s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id dr9-20020a170907720900b0078cffd3ce3esi18229932ejc.654.2022.10.22.01.46.40; Sat, 22 Oct 2022 01:47:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=kQJtik8s; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234826AbiJVIqL (ORCPT + 99 others); Sat, 22 Oct 2022 04:46:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234902AbiJVIn7 (ORCPT ); Sat, 22 Oct 2022 04:43:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8EADC2D5E90; Sat, 22 Oct 2022 01:07:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 363F760B93; Sat, 22 Oct 2022 08:07:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21FEFC43470; Sat, 22 Oct 2022 08:07:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666426038; bh=NnJ0YjbfDryTNsgBnYfvkTFfLDik9g6cRLQCeZMJaHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kQJtik8s0x6RfwbSMuk9ym1Lu8mSD+/Alehwc4ZTkRUlxilnuU9dHnOxJdMqQUgi+ IvWtFv0vwgspaZN45W1e19a9aDqM1p0IBCkLx6ofDeNK86COeuORsroh5AdssIyMNf shmyCRlWBaKWqIQrrw8UgCV8X2tnGyN8hdjfGek8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liu Shixin , Kefeng Wang , syzbot+193f9cee8638750b23cf@syzkaller.appspotmail.com, Liu Zixian , Mike Kravetz , David Hildenbrand , John Hubbard , Muchun Song , Sidhartha Kumar , Andrew Morton Subject: [PATCH 5.19 699/717] mm: hugetlb: fix UAF in hugetlb_handle_userfault Date: Sat, 22 Oct 2022 09:29:38 +0200 Message-Id: <20221022072529.365729689@linuxfoundation.org> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221022072415.034382448@linuxfoundation.org> References: <20221022072415.034382448@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.3 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747376853068471494?= X-GMAIL-MSGID: =?utf-8?q?1747376853068471494?= From: Liu Shixin commit 958f32ce832ba781ac20e11bb2d12a9352ea28fc upstream. The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/ Link: https://lkml.kernel.org/r/20220923042113.137273-1-liushixin2@huawei.com Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook") Signed-off-by: Liu Shixin Signed-off-by: Kefeng Wang Reported-by: syzbot+193f9cee8638750b23cf@syzkaller.appspotmail.com Reported-by: Liu Zixian Reviewed-by: Mike Kravetz Cc: David Hildenbrand Cc: John Hubbard Cc: Muchun Song Cc: Sidhartha Kumar Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman --- mm/hugetlb.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5467,7 +5467,6 @@ static inline vm_fault_t hugetlb_handle_ unsigned long addr, unsigned long reason) { - vm_fault_t ret; u32 hash; struct vm_fault vmf = { .vma = vma, @@ -5485,18 +5484,14 @@ static inline vm_fault_t hugetlb_handle_ }; /* - * hugetlb_fault_mutex and i_mmap_rwsem must be - * dropped before handling userfault. Reacquire - * after handling fault to make calling code simpler. + * vma_lock and hugetlb_fault_mutex must be dropped before handling + * userfault. Also mmap_lock will be dropped during handling + * userfault, any vma operation should be careful from here. */ hash = hugetlb_fault_mutex_hash(mapping, idx); mutex_unlock(&hugetlb_fault_mutex_table[hash]); i_mmap_unlock_read(mapping); - ret = handle_userfault(&vmf, reason); - i_mmap_lock_read(mapping); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - - return ret; + return handle_userfault(&vmf, reason); } static vm_fault_t hugetlb_no_page(struct mm_struct *mm, @@ -5514,6 +5509,7 @@ static vm_fault_t hugetlb_no_page(struct spinlock_t *ptl; unsigned long haddr = address & huge_page_mask(h); bool new_page, new_pagecache_page = false; + u32 hash = hugetlb_fault_mutex_hash(mapping, idx); /* * Currently, we are forced to kill the process in the event the @@ -5524,7 +5520,7 @@ static vm_fault_t hugetlb_no_page(struct if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) { pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n", current->pid); - return ret; + goto out; } /* @@ -5541,12 +5537,10 @@ retry: page = find_lock_page(mapping, idx); if (!page) { /* Check for page in userfault range */ - if (userfaultfd_missing(vma)) { - ret = hugetlb_handle_userfault(vma, mapping, idx, + if (userfaultfd_missing(vma)) + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MISSING); - goto out; - } page = alloc_huge_page(vma, haddr, 0); if (IS_ERR(page)) { @@ -5606,10 +5600,9 @@ retry: if (userfaultfd_minor(vma)) { unlock_page(page); put_page(page); - ret = hugetlb_handle_userfault(vma, mapping, idx, + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MINOR); - goto out; } } @@ -5667,6 +5660,8 @@ retry: unlock_page(page); out: + mutex_unlock(&hugetlb_fault_mutex_table[hash]); + i_mmap_unlock_read(mapping); return ret; backout: @@ -5765,11 +5760,13 @@ vm_fault_t hugetlb_fault(struct mm_struc entry = huge_ptep_get(ptep); /* PTE markers should be handled the same way as none pte */ - if (huge_pte_none_mostly(entry)) { - ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep, + if (huge_pte_none_mostly(entry)) + /* + * hugetlb_no_page will drop vma lock and hugetlb fault + * mutex internally, which make us return immediately. + */ + return hugetlb_no_page(mm, vma, mapping, idx, address, ptep, entry, flags); - goto out_mutex; - } ret = 0;