On Thu, Jul 18, 2024 at 9:44 AM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > > On Thu, Jul 18, 2024 at 6:42 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote: > > > > On Thu, Jul 18, 2024 at 4:36 PM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > > > > > > On Thu, Jul 18, 2024 at 04:23:47PM +0000, Suren Baghdasaryan wrote: > > > > On Thu, Jul 18, 2024 at 4:20 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote: > > > > > > > > > > On Thu, Jul 18, 2024 at 3:43 PM Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> wrote: > > > > > > > > > > > > * Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx> [240718 07:00]: > > > > > > > On 7/16/24 10:29 AM, syzbot wrote: > > > > > > > > Hello, > > > > > > > > > > > > > > dunno about the [crypto?] parts, sounds rather something for Suren or Liam > > > > > > > or maybe it's due to some changes to gup? > > > > > > > > > > > > Yes, that crypto part is very odd. > > > > > > > > > > > > > > > > > > > > > syzbot found the following issue on: > > > > > > > > > > > > > > > > HEAD commit: 3fe121b62282 Add linux-next specific files for 20240712 > > > > > > > > git tree: linux-next > > > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1097ebed980000 > > > > > > > > kernel config: https://syzkaller.appspot.com/x/.config?x=98dd8c4bab5cdce > > > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=4c882a4a0697c4a25364 > > > > > > > > compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40 > > > > > > > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11d611a5980000 > > > > > > > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13ce3259980000 > > > > > > > > > > > > > > > > Downloadable assets: > > > > > > > > disk image: https://storage.googleapis.com/syzbot-assets/8c6fbf69718d/disk-3fe121b6.raw.xz > > > > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/39fc7e43dfc1/vmlinux-3fe121b6.xz > > > > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/0a78e70e4b4e/bzImage-3fe121b6.xz > > > > > > > > mounted in repro: https://storage.googleapis.com/syzbot-assets/66cfe5a679f2/mount_0.gz > > > > > > > > > > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > > > > > > > Reported-by: syzbot+4c882a4a0697c4a25364@xxxxxxxxxxxxxxxxxxxxxxxxx > > > > > > > > > > > > > > > > ================================================================== > > > > > > > > BUG: KASAN: slab-use-after-free in handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842 > > > > > > > > Read of size 8 at addr ffff88802c4719d0 by task syz-executor125/5235 > > > > > > > > > > > > > > > > CPU: 1 UID: 0 PID: 5235 Comm: syz-executor125 Not tainted 6.10.0-rc7-next-20240712-syzkaller #0 > > > > > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 > > > > > > > > Call Trace: > > > > > > > > <TASK> > > > > > > > > __dump_stack lib/dump_stack.c:94 [inline] > > > > > > > > dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 > > > > > > > > print_address_description mm/kasan/report.c:377 [inline] > > > > > > > > print_report+0x169/0x550 mm/kasan/report.c:488 > > > > > > > > kasan_report+0x143/0x180 mm/kasan/report.c:601 > > > > > > > > handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842 > > > > > > > > > > > > /* > > > > > > * By the time we get here, we already hold the mm semaphore > > > > > > * > > > > > > * The mmap_lock may have been released depending on flags and our > > > > > > * return value. See filemap_fault() and __folio_lock_or_retry(). > > > > > > */ > > > > > > > > > > > > Somehow we are here without an RCU or mmap_lock held? > > > > > > > > > > I'm guessing we did enter handle_mm_fault() with mmap_lock held but > > > > > __handle_mm_fault() dropped it before returning, see the comment for > > > > > __handle_mm_fault(): > > > > > > > > > > /* > > > > > * On entry, we hold either the VMA lock or the mmap_lock > > > > > * (FAULT_FLAG_VMA_LOCK tells you which). If VM_FAULT_RETRY is set in > > > > > * the result, the mmap_lock is not held on exit. See filemap_fault() > > > > > * and __folio_lock_or_retry(). > > > > > */ > > > > > > > > > > So after that there is nothing that guarantees VMA is not destroyed > > > > > from under us and if (vma->vm_flags & VM_DROPPABLE) check is unsafe. > > > > > Hillf's suggestion should fix this issue but we need to figure out how > > > > > to make this path more robust. Currently it's very easy to make a > > > > > similar mistake. Maybe a WARNING comment after __handle_mm_fault() > > > > > that VMA might be unstable after that function and should not be used? > > > > > > > > CC'ing Jason. > > > > > > Thanks for bringing this to my attention. I'll incorporate Hillf's patch > > > and also add a comment as you suggested. Something like the below? > > > > > > diff --git a/mm/memory.c b/mm/memory.c > > > index 18fe893ce96d..f596a8d508ef 100644 > > > --- a/mm/memory.c > > > +++ b/mm/memory.c > > > @@ -5660,6 +5660,7 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address, > > > /* If the fault handler drops the mmap_lock, vma may be freed */ > > > struct mm_struct *mm = vma->vm_mm; > > > vm_fault_t ret; > > > + bool is_droppable; > > > > > > __set_current_state(TASK_RUNNING); > > > > > > @@ -5674,6 +5675,8 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address, > > > goto out; > > > } > > > > > > + is_droppable = !!(vma->vm_flags & VM_DROPPABLE); > > > + > > > /* > > > * Enable the memcg OOM handling for faults triggered in user > > > * space. Kernel faults are handled more gracefully. > > > @@ -5688,10 +5691,15 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address, > > > else > > > ret = __handle_mm_fault(vma, address, flags); > > > > > > + /* > > > + * It is no longer safe to dereference vma-> after this point, as > > > + * __handle_mm_fault may have already destroyed it. > > > > __handle_mm_fault does not really destroy the vma. It might drop > > mmap_lock and another task might destroy it from under us. > > Err, right. Okay, wording time: > > > Warning: It is no longer safe to dereference vma-> after this point, because mmap_lock is dropped, so vma might be destroyed from underneath us. Better but I would change "mmap_lock is dropped" to "mmap_lock might have been dropped by __handle_mm_fault()" because mmap_lock is not always dropped by __handle_mm_fault(). Technicality but better be clear about it. With that changed feel free to add: Reviewed-by: Suren Baghdasaryan <surenb@xxxxxxxxxx> > > How about that?
