On Fri, 23 Sep 2022 12:21:13 +0800 Liu Shixin <liushixin2@xxxxxxxxxx> wrote: > The vma_lock and hugetlb_fault_mutex are dropped before handling > userfault and reacquire them again after handle_userfault(), but > reacquire the vma_lock could lead to UAF[1,2] due to the following > race, > > hugetlb_fault > hugetlb_no_page > /*unlock vma_lock */ > hugetlb_handle_userfault > handle_userfault > /* unlock mm->mmap_lock*/ > vm_mmap_pgoff > do_mmap > mmap_region > munmap_vma_range > /* clean old vma */ > /* lock vma_lock again <--- UAF */ > /* unlock vma_lock */ > > Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), > let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix > the issue. > > [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@xxxxxxxxxx/ > [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@xxxxxxxxxx/ > Reported-by: syzbot+193f9cee8638750b23cf@xxxxxxxxxxxxxxxxxxxxxxxxx > Reported-by: Liu Zixian <liuzixian4@xxxxxxxxxx> > Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook") > CC: stable@xxxxxxxxxxxxxxx # 4.14+ Patch is against mm-unstable, which isn't appropriate for a backport. Could you please something against current -linus (which will be more backportable), then I'll figure out the fallout on mm-unstable. Thanks.
