From patchwork Fri Sep 29 17:19:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 148947 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2016:b0:403:3b70:6f57 with SMTP id fe22csp449638vqb; Thu, 5 Oct 2023 10:19:52 -0700 (PDT) X-Google-Smtp-Source: AGHT+IERwXoxGA+gkfJVTN/Ana1l8GahW+gla6sqqZNipqC4iecPfN/RtuXRkYU121gWzy3scmJk X-Received: by 2002:a05:6358:4311:b0:13c:fd78:bb43 with SMTP id r17-20020a056358431100b0013cfd78bb43mr5564728rwc.27.1696526392494; Thu, 05 Oct 2023 10:19:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696526392; cv=none; d=google.com; s=arc-20160816; b=A69VHLuLwe3z6PsAOkB2Ol4hcbprNuJUhRRXzNGVDFMijyA6BWIa3Hakab4VYUzXRY 9vTkUmEFh+mas6oAlnANda+25Eq8pf/DZD0j3B7KZI8/ylOF9u7EiYr9K+W37SQXkKgf eUcJa2shCTUOyS4CgnNjAM+PKhuRhO4WpsIqBMtsD7Q3qS8o0tdJ+ABDVBbsbHwObwjU leeZWcp2TGyNrfEvcv9ZREcvLkQ2ATxcHZ525ru75UEtDNpcmS3XAqTY25LC/9k9jaTi 6padVO0i9iahOblp2b3nT/ljfNDfatczkD4VLX8+XRwXW/Jdlj3J9nlfI8B4A9tNCTE4 6Zaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=PHLaFEhV7E7Wr2RxX57WFG0eWfYlTCzFdKjwWaRfRTI=; fh=WWPIq6wyYq8pJyolk8d1R4fUu8kxdXRzD3KrDzlen9E=; b=z0jjM943FlXbyu8fL8gThgTH1yWyhyIvi03Lu90JmFKL9oSA/lJOlurw0pJ5ZAggXT DMmafyrk/42k7+9UZ385bchgYCo6zcOgcyxsBiqjLAylR+ViF9GsZfn8+2IHpRmlkQfx XuWz7tjxh4uBLojXQK3yz53idzijOidBYpdhCZwYGZ0DCsvlkH0oDcGXGLml9ZQvE2de fPbKdE+EURLS7k2MwmYG89q1ewVusObzlUjDTG3IltP/Tsm3QyrhEuRMngEFyLAetxOI DV0+isTTrB480TmPRaXwqUI4WsjgUxupVMHmPafPP27umGLejwI4Tbxlpm5iPxsClpXe ukwg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=TevKiKzV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from morse.vger.email (morse.vger.email. [2620:137:e000::3:1]) by mx.google.com with ESMTPS id 126-20020a630084000000b0057760853706si1879125pga.578.2023.10.05.10.19.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Oct 2023 10:19:52 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) client-ip=2620:137:e000::3:1; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=TevKiKzV; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:1 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by morse.vger.email (Postfix) with ESMTP id 4BACA801B82A; Fri, 29 Sep 2023 10:19:55 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at morse.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233141AbjI2RTr (ORCPT + 19 others); Fri, 29 Sep 2023 13:19:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36292 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232800AbjI2RTq (ORCPT ); Fri, 29 Sep 2023 13:19:46 -0400 Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 500EA1A7 for ; Fri, 29 Sep 2023 10:19:44 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id d9443c01a7336-1c5ff5f858dso83760095ad.2 for ; Fri, 29 Sep 2023 10:19:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1696007984; x=1696612784; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=PHLaFEhV7E7Wr2RxX57WFG0eWfYlTCzFdKjwWaRfRTI=; b=TevKiKzVLSu//YO+gWTFKSeTqr6dlYRTM1QDKYy5i0LG1BBB3K4BV1vVMdXBR1nrhY nGFNNM4JcXv/NxPqIeDCiUnOulp8xRDITSZJK6yTD3GoBIdNSn+3a5+3AJFdUmOUFnX5 jyG6Qp4Qfhj8776PB7OK1eJFMjUETjSsEdR78= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696007984; x=1696612784; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=PHLaFEhV7E7Wr2RxX57WFG0eWfYlTCzFdKjwWaRfRTI=; b=SBf9z9LfhWMJYO38BN+bNERAg//I3Z//+a3zKfiolmVLv74SlswhXPD/rR81nvyZ/4 pI1QKZOpoSaMzbiZt4AykTKWmGoafTAVs/lNwpBr+XfbGGFHWnsgX6Nlt2HOUMbJUTdG x85+iDMBtjaur3R1ELEfonO4qlXnfpHIKSinXyNbM/JcUHO3zhhxZppAuyl3FLf7xar7 pEM5VV9aMqPadtl7GxpimtFaM8CjR1U/JJUFpnl1Q4DLVggZG5Sk8wXKCQLRNwlSiB2Q UfUMbe934I6VV7TguDUklzPpP4FuFPhPKHCz3vk+8MNVA6937YeQrucvmYC5RonTcrBW zPRA== X-Gm-Message-State: AOJu0Yx3ltYPEnC+vx1PWnFuog7sYCtY4OlbCeRvdtqb74OOYOBpmOpt tvqv0JRbxcJpog4LFjJPW9yoGQ== X-Received: by 2002:a17:902:ed01:b0:1c5:f7e2:c5e0 with SMTP id b1-20020a170902ed0100b001c5f7e2c5e0mr4502012pld.51.1696007983764; Fri, 29 Sep 2023 10:19:43 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id q11-20020a17090311cb00b001c3721897fcsm17194797plh.277.2023.09.29.10.19.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Sep 2023 10:19:43 -0700 (PDT) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Sebastian Ott , "Liam R . Howlett" , Yu Zhao , linux-mm@kvack.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] mm: Fix vm_brk_flags() to not bail out while holding lock Date: Fri, 29 Sep 2023 10:19:41 -0700 Message-Id: <20230929171937.work.697-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1274; i=keescook@chromium.org; h=from:subject:message-id; bh=kjc+Ho0zH8hMf0DrfoD4hY2yzRf3D1zV5oxVn64EmhQ=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBlFwcsmyZwvSPygxpmP4hn9DkGcWeEJYFxatCVu LY41wP2IpqJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZRcHLAAKCRCJcvTf3G3A JlguD/9d9nsZNBs2QjqPxwbWrX6olpQxz+BmHTRDmOKl6koWi9bnlqJ8QU1UTR3wUeG0XljNk4T cHSnKajVXQL+tuWV31HM+2HKRSgdBtjjsEkt8PRbBKrFyIg5r9ATi4pNmPDs2lfnobhcju+36Dv 6wUwdLWAxaQSFlNVzAQmM5Eb4OIfXq7A0/HMMPHXjHnyDNApYafc5/+X784UWzV63b3X/8mnanO WcVQpQl/Bl5X0XWiedkXVUVtiFH3+H6NLFRpRKyGOYIlyGKbZFZzU+ZFEDWYL6pKv6ToRTzloNx UK/QzZoEBEi88it2hkeKqFpJU6bbmL67TefXFiFfTbLY8fkAKo7qM6aYirnWgo2YrSbb80sR/2K tB5RajiedOGGHu/lA+iGrLt3c2CRkcxnUkbfjv/kUmKSZkorYAC5komXHLmlQk8FRIGNhyxO950 ZA/QPiKwhWYZtYb4O6TjcAbCK/i2rnHJIB5rI5y43nHTap+wWfshxGrZXkx9sLuHiKTjFenqwJd CJRbT0/IekKDqGs+Sl6xBlix5bqus6L/VugSgbq3Xhn0+Vs4Cn+WuPPCRJKZXyIb8RRGQZul1Og tfW5zP/eiQdXezh0+JkyUPIOQhXySdBrvNCGVhY7APhi9Etin9mclEUOwHxuhg+WsheM1ks5fHL /FNiA2i FHjNKwnw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on morse.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (morse.vger.email [0.0.0.0]); Fri, 29 Sep 2023 10:19:55 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778413422801246100 X-GMAIL-MSGID: 1778936858421377104 From: Sebastian Ott Calling vm_brk_flags() with flags set other than VM_EXEC will exit the function without releasing the mmap_write_lock. Just do the sanity check before the lock is acquired. This doesn't fix an actual issue since no caller sets a flag other than VM_EXEC. Cc: Andrew Morton Cc: Liam R. Howlett Cc: Yu Zhao Cc: linux-mm@kvack.org Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()") Signed-off-by: Sebastian Ott Signed-off-by: Kees Cook --- mm/mmap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 34d2337ace59..c8996fe847c9 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -3143,13 +3143,13 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) if (!len) return 0; - if (mmap_write_lock_killable(mm)) - return -EINTR; - /* Until we need other flags, refuse anything except VM_EXEC. */ if ((flags & (~VM_EXEC)) != 0) return -EINVAL; + if (mmap_write_lock_killable(mm)) + return -EINTR; + ret = check_brk_limits(addr, len); if (ret) goto limits_failed;