Kefeng, et al, sorry I am travelling till the next monday, can't even open my laptop too often. On 08/16, Kefeng Wang wrote: > > The patch do fix the UAF and avoid panic, and it doesn't seem to cause new issue, > even if there are some another issue, it can be fixed later :) Yes... but if we want a hot fix without any understanding why does it help in this particular case we can simply add mmget_still_valid() into handle_userfault(), I am almost sure this should equally "fix" (hide) the problem. But to clarify, let me repeat that I still think the patch I sent makes sense anyway; __handle_mm_fault() is possible even after do_coredump() sets mm->core_state and after userfaultfd_unregister(). > >> [ 67.430243] RIP: 0010:copy_user_handle_tail+0x2/0x10 > >> [ 67.431586] Code: c3 0f 1f 80 00 00 00 00 66 66 90 83 fa 40 0f 82 70 ff ff ff 89 d1 f3 a4 31 c0 66 66 90 c3 66 2e 0f 1f 84 00 00 00 00 00 89 d1 <f3> a4 89 c8 66 66 90 c3 66 0f 1f 44 00 00 66 66 90 83 fa 08 0f 82 > >> [ 67.436978] RSP: 0018:ffff8883c4e8f908 EFLAGS: 00010246 > >> [ 67.438743] RAX: 0000000000000001 RBX: 0000000020ffd000 RCX: 0000000000001000 > >> [ 67.441101] RDX: 0000000000001000 RSI: 0000000020ffd000 RDI: ffff8883c0aa4000 > >> [ 67.442865] RBP: 0000000000001000 R08: ffffed1078154a00 R09: 0000000000000000 > >> [ 67.444534] R10: 0000000000000200 R11: ffffed10781549ff R12: ffff8883c0aa4000 > >> [ 67.446216] R13: ffff8883c6096000 R14: ffff88837721f838 R15: ffff8883c6096000 > >> [ 67.448388] _copy_from_user+0xa1/0xd0 > >> [ 67.449655] mcopy_atomic+0xb3d/0x1380 > >> [ 67.450991] ? lock_downgrade+0x3a0/0x3a0 > >> [ 67.452337] ? mm_alloc_pmd+0x130/0x130 > >> [ 67.453618] ? __might_fault+0x7d/0xe0 > >> [ 67.454980] userfaultfd_ioctl+0x14a2/0x1c30 > > > > This must not be called after __fput(). So I think there is something else, > > may by just an unbalanced userfaultfd_ctx_put(). I dunno, I know nothing > > about usefaultfd. > > There are different processes, maybe some concurrency problems. and this is what I think we need to understand... > > It would be nice to understand what this reproducer does... > > I tried strace -f the reproducer, but can't find any useful info. Could you send me the output of strace -f ? Not sure it will help and again, I am not sure I will have a chance to read it this week. Perhaps it is possible to translate this test-case to C somehow? Oleg.
