The patch titled
Subject: mm: pgtable: make ptlock be freed by RCU
has been added to the -mm mm-unstable branch. Its filename is
mm-pgtable-make-ptlock-be-freed-by-rcu.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/mm-pgtable-make-ptlock-be-freed-by-rcu.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>
Subject: mm: pgtable: make ptlock be freed by RCU
Date: Tue, 10 Dec 2024 16:44:31 +0800
If ALLOC_SPLIT_PTLOCKS is enabled, the ptdesc->ptl will be a pointer and a
ptlock will be allocated for it, and it will be freed immediately before
the PTE page is freed. Once we support empty PTE page reclaimation, it
may result in the following use-after-free problem:
CPU 0 CPU 1
pte_offset_map_rw_nolock(&ptlock)
--> rcu_read_lock()
madvise(MADV_DONTNEED)
--> ptlock_free (free ptlock immediately!)
free PTE page via RCU
/* UAF!! */
spin_lock(ptlock)
To avoid this problem, make ptlock also be freed by RCU.
Link: https://lkml.kernel.org/r/20241210084431.91414-1-zhengqi.arch@xxxxxxxxxxxxx
Signed-off-by: Qi Zheng <zhengqi.arch@xxxxxxxxxxxxx>
Reported-by: syzbot+1c58afed1cfd2f57efee@xxxxxxxxxxxxxxxxxxxxxxxxx
Tested-by: syzbot+1c58afed1cfd2f57efee@xxxxxxxxxxxxxxxxxxxxxxxxx
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
Cc: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Cc: David Hildenbrand <david@xxxxxxxxxx>
Cc: David Rientjes <rientjes@xxxxxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: Jann Horn <jannh@xxxxxxxxxx>
Cc: Lorenzo Stoakes <lorenzo.stoakes@xxxxxxxxxx>
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: Mel Gorman <mgorman@xxxxxxx>
Cc: Muchun Song <muchun.song@xxxxxxxxx>
Cc: Peter Xu <peterx@xxxxxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Will Deacon <will@xxxxxxxxxx>
Cc: Zach O'Keefe <zokeefe@xxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
include/linux/mm.h | 2 +-
include/linux/mm_types.h | 9 ++++++++-
mm/memory.c | 22 ++++++++++++++++------
3 files changed, 25 insertions(+), 8 deletions(-)
--- a/include/linux/mm.h~mm-pgtable-make-ptlock-be-freed-by-rcu
+++ a/include/linux/mm.h
@@ -2925,7 +2925,7 @@ void ptlock_free(struct ptdesc *ptdesc);
static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)
{
- return ptdesc->ptl;
+ return &(ptdesc->ptl->ptl);
}
#else /* ALLOC_SPLIT_PTLOCKS */
static inline void ptlock_cache_init(void)
--- a/include/linux/mm_types.h~mm-pgtable-make-ptlock-be-freed-by-rcu
+++ a/include/linux/mm_types.h
@@ -434,6 +434,13 @@ FOLIO_MATCH(flags, _flags_2a);
FOLIO_MATCH(compound_head, _head_2a);
#undef FOLIO_MATCH
+#if ALLOC_SPLIT_PTLOCKS
+struct pt_lock {
+ spinlock_t ptl;
+ struct rcu_head rcu;
+};
+#endif
+
/**
* struct ptdesc - Memory descriptor for page tables.
* @__page_flags: Same as page flags. Powerpc only.
@@ -478,7 +485,7 @@ struct ptdesc {
union {
unsigned long _pt_pad_2;
#if ALLOC_SPLIT_PTLOCKS
- spinlock_t *ptl;
+ struct pt_lock *ptl;
#else
spinlock_t ptl;
#endif
--- a/mm/memory.c~mm-pgtable-make-ptlock-be-freed-by-rcu
+++ a/mm/memory.c
@@ -7013,24 +7013,34 @@ static struct kmem_cache *page_ptl_cache
void __init ptlock_cache_init(void)
{
- page_ptl_cachep = kmem_cache_create("page->ptl", sizeof(spinlock_t), 0,
+ page_ptl_cachep = kmem_cache_create("page->ptl", sizeof(struct pt_lock), 0,
SLAB_PANIC, NULL);
}
bool ptlock_alloc(struct ptdesc *ptdesc)
{
- spinlock_t *ptl;
+ struct pt_lock *pt_lock;
- ptl = kmem_cache_alloc(page_ptl_cachep, GFP_KERNEL);
- if (!ptl)
+ pt_lock = kmem_cache_alloc(page_ptl_cachep, GFP_KERNEL);
+ if (!pt_lock)
return false;
- ptdesc->ptl = ptl;
+ ptdesc->ptl = pt_lock;
return true;
}
+static void ptlock_free_rcu(struct rcu_head *head)
+{
+ struct pt_lock *pt_lock;
+
+ pt_lock = container_of(head, struct pt_lock, rcu);
+ kmem_cache_free(page_ptl_cachep, pt_lock);
+}
+
void ptlock_free(struct ptdesc *ptdesc)
{
- kmem_cache_free(page_ptl_cachep, ptdesc->ptl);
+ struct pt_lock *pt_lock = ptdesc->ptl;
+
+ call_rcu(&pt_lock->rcu, ptlock_free_rcu);
}
#endif
_
Patches currently in -mm which might be from zhengqi.arch@xxxxxxxxxxxxx are
mm-pgtable-make-ptep_clear-non-atomic.patch
mm-khugepaged-recheck-pmd-state-in-retract_page_tables.patch
mm-userfaultfd-recheck-dst_pmd-entry-in-move_pages_pte.patch
mm-userfaultfd-recheck-dst_pmd-entry-in-move_pages_pte-fix.patch
mm-introduce-zap_nonpresent_ptes.patch
mm-introduce-do_zap_pte_range.patch
mm-skip-over-all-consecutive-none-ptes-in-do_zap_pte_range.patch
mm-zap_install_uffd_wp_if_needed-return-whether-uffd-wp-pte-has-been-re-installed.patch
mm-do_zap_pte_range-return-any_skipped-information-to-the-caller.patch
mm-make-zap_pte_range-handle-full-within-pmd-range.patch
mm-pgtable-reclaim-empty-pte-page-in-madvisemadv_dontneed.patch
mm-pgtable-reclaim-empty-pte-page-in-madvisemadv_dontneed-fix.patch
x86-mm-free-page-table-pages-by-rcu-instead-of-semi-rcu.patch
mm-pgtable-make-ptlock-be-freed-by-rcu.patch
x86-select-arch_supports_pt_reclaim-if-x86_64.patch
