Re: [syzbot] [crypto?] KASAN: slab-use-after-free Read in handle_mm_fault

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jul 18, 2024 at 9:44 AM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote:
>
> On Thu, Jul 18, 2024 at 6:42 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
> >
> > On Thu, Jul 18, 2024 at 4:36 PM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote:
> > >
> > > On Thu, Jul 18, 2024 at 04:23:47PM +0000, Suren Baghdasaryan wrote:
> > > > On Thu, Jul 18, 2024 at 4:20 PM Suren Baghdasaryan <surenb@xxxxxxxxxx> wrote:
> > > > >
> > > > > On Thu, Jul 18, 2024 at 3:43 PM Liam R. Howlett <Liam.Howlett@xxxxxxxxxx> wrote:
> > > > > >
> > > > > > * Vlastimil Babka (SUSE) <vbabka@xxxxxxxxxx> [240718 07:00]:
> > > > > > > On 7/16/24 10:29 AM, syzbot wrote:
> > > > > > > > Hello,
> > > > > > >
> > > > > > > dunno about the [crypto?] parts, sounds rather something for Suren or Liam
> > > > > > > or maybe it's due to some changes to gup?
> > > > > >
> > > > > > Yes, that crypto part is very odd.
> > > > > >
> > > > > > >
> > > > > > > > syzbot found the following issue on:
> > > > > > > >
> > > > > > > > HEAD commit:    3fe121b62282 Add linux-next specific files for 20240712
> > > > > > > > git tree:       linux-next
> > > > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1097ebed980000
> > > > > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=98dd8c4bab5cdce
> > > > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=4c882a4a0697c4a25364
> > > > > > > > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> > > > > > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11d611a5980000
> > > > > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13ce3259980000
> > > > > > > >
> > > > > > > > Downloadable assets:
> > > > > > > > disk image: https://storage.googleapis.com/syzbot-assets/8c6fbf69718d/disk-3fe121b6.raw.xz
> > > > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/39fc7e43dfc1/vmlinux-3fe121b6.xz
> > > > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/0a78e70e4b4e/bzImage-3fe121b6.xz
> > > > > > > > mounted in repro: https://storage.googleapis.com/syzbot-assets/66cfe5a679f2/mount_0.gz
> > > > > > > >
> > > > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > > > > > Reported-by: syzbot+4c882a4a0697c4a25364@xxxxxxxxxxxxxxxxxxxxxxxxx
> > > > > > > >
> > > > > > > > ==================================================================
> > > > > > > > BUG: KASAN: slab-use-after-free in handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842
> > > > > > > > Read of size 8 at addr ffff88802c4719d0 by task syz-executor125/5235
> > > > > > > >
> > > > > > > > CPU: 1 UID: 0 PID: 5235 Comm: syz-executor125 Not tainted 6.10.0-rc7-next-20240712-syzkaller #0
> > > > > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
> > > > > > > > Call Trace:
> > > > > > > >  <TASK>
> > > > > > > >  __dump_stack lib/dump_stack.c:94 [inline]
> > > > > > > >  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > > > > > > >  print_address_description mm/kasan/report.c:377 [inline]
> > > > > > > >  print_report+0x169/0x550 mm/kasan/report.c:488
> > > > > > > >  kasan_report+0x143/0x180 mm/kasan/report.c:601
> > > > > > > >  handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842
> > > > > >
> > > > > > /*
> > > > > >  * By the time we get here, we already hold the mm semaphore
> > > > > >  *
> > > > > >  * The mmap_lock may have been released depending on flags and our
> > > > > >  * return value.  See filemap_fault() and __folio_lock_or_retry().
> > > > > >  */
> > > > > >
> > > > > > Somehow we are here without an RCU or mmap_lock held?
> > > > >
> > > > > I'm guessing we did enter handle_mm_fault() with mmap_lock held but
> > > > > __handle_mm_fault() dropped it before returning, see the comment for
> > > > > __handle_mm_fault():
> > > > >
> > > > > /*
> > > > >  * On entry, we hold either the VMA lock or the mmap_lock
> > > > >  * (FAULT_FLAG_VMA_LOCK tells you which).  If VM_FAULT_RETRY is set in
> > > > >  * the result, the mmap_lock is not held on exit.  See filemap_fault()
> > > > >  * and __folio_lock_or_retry().
> > > > >  */
> > > > >
> > > > > So after that there is nothing that guarantees VMA is not destroyed
> > > > > from under us and if (vma->vm_flags & VM_DROPPABLE) check is unsafe.
> > > > > Hillf's suggestion should fix this issue but we need to figure out how
> > > > > to make this path more robust. Currently it's very easy to make a
> > > > > similar mistake. Maybe a WARNING comment after __handle_mm_fault()
> > > > > that VMA might be unstable after that function and should not be used?
> > > >
> > > > CC'ing Jason.
> > >
> > > Thanks for bringing this to my attention. I'll incorporate Hillf's patch
> > > and also add a comment as you suggested. Something like the below?
> > >
> > > diff --git a/mm/memory.c b/mm/memory.c
> > > index 18fe893ce96d..f596a8d508ef 100644
> > > --- a/mm/memory.c
> > > +++ b/mm/memory.c
> > > @@ -5660,6 +5660,7 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
> > >         /* If the fault handler drops the mmap_lock, vma may be freed */
> > >         struct mm_struct *mm = vma->vm_mm;
> > >         vm_fault_t ret;
> > > +       bool is_droppable;
> > >
> > >         __set_current_state(TASK_RUNNING);
> > >
> > > @@ -5674,6 +5675,8 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
> > >                 goto out;
> > >         }
> > >
> > > +       is_droppable = !!(vma->vm_flags & VM_DROPPABLE);
> > > +
> > >         /*
> > >          * Enable the memcg OOM handling for faults triggered in user
> > >          * space.  Kernel faults are handled more gracefully.
> > > @@ -5688,10 +5691,15 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
> > >         else
> > >                 ret = __handle_mm_fault(vma, address, flags);
> > >
> > > +       /*
> > > +        * It is no longer safe to dereference vma-> after this point, as
> > > +        * __handle_mm_fault may have already destroyed it.
> >
> > __handle_mm_fault does not really destroy the vma. It might drop
> > mmap_lock and another task might destroy it from under us.
>
> Err, right. Okay, wording time:
>
> > Warning: It is no longer safe to dereference vma-> after this point, because mmap_lock is dropped, so vma might be destroyed from underneath us.

Better but I would change "mmap_lock is dropped" to "mmap_lock might
have been dropped by __handle_mm_fault()" because mmap_lock is not
always dropped by __handle_mm_fault(). Technicality but better be
clear about it.
With that changed feel free to add:

Reviewed-by: Suren Baghdasaryan <surenb@xxxxxxxxxx>

>
> How about that?





[Index of Archives]     [Kernel]     [Gnu Classpath]     [Gnu Crypto]     [DM Crypt]     [Netfilter]     [Bugtraq]
  Powered by Linux