From patchwork Tue Feb 22 05:40:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suren Baghdasaryan X-Patchwork-Id: 12754556 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DDF3C433F5 for ; Tue, 22 Feb 2022 05:40:37 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B78E38D0005; Tue, 22 Feb 2022 00:40:36 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id B287A8D0001; Tue, 22 Feb 2022 00:40:36 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9F1888D0005; Tue, 22 Feb 2022 00:40:36 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0033.hostedemail.com [216.40.44.33]) by kanga.kvack.org (Postfix) with ESMTP id 9267A8D0001 for ; Tue, 22 Feb 2022 00:40:36 -0500 (EST) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 3D7D9181CAEE0 for ; Tue, 22 Feb 2022 05:40:36 +0000 (UTC) X-FDA: 79169316072.24.8BA6CD9 Received: from mail-yw1-f201.google.com (mail-yw1-f201.google.com [209.85.128.201]) by imf14.hostedemail.com (Postfix) with ESMTP id 9A5C0100004 for ; Tue, 22 Feb 2022 05:40:35 +0000 (UTC) Received: by mail-yw1-f201.google.com with SMTP id 00721157ae682-2d646d12df2so132149417b3.9 for ; Mon, 21 Feb 2022 21:40:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=qqyEPHhtNcMIuHzofZyfR4VdGZXTrt+4dSmkIwliqsc=; b=IKHOwo4Dx8CMc91mjHwFli7xuzNosMgEP9RN+83t9bNE3LFI3FV050mQYjbw9eTMc9 vXXISkC1t3BaOVQ36wn7IqyzuQ9cz0Gix56/PeGDmfqkvtHyoagz+h+Qm7+dp3yVYKAp xnF1aa6r4TyBKfghqeg7vnbiab282PzTmsxYsz6XYZOowHJv7OAB0jiSOVCW1G30uaz2 u4NR+JKLWg3CF4wM19oBuxjOFD5MCp+bpPFNuUngMqx5y9hes4Qfr+jIY3iEYUAFr0jN x4PWlDvGSKHUYvgx261OxZwcG8tEoZcR1/0O4xpds4xRwtpnVe19ma+udm+p6B+O3FpA tT8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=qqyEPHhtNcMIuHzofZyfR4VdGZXTrt+4dSmkIwliqsc=; b=uzegxECjzmVEY/fMWDmpzNx3NKYGTjl6VntU4QEIpGgX+2WnO40XzkqSq+6FsweaOp NM78BijJIJ2sMgIDygwberkLiotXSDO0LBG/GwSlbHaOnJ09TIYgzNuFxyJHi/Ws4v1a INS4CSj9oxJsbXU+9aDq73QHIp1KoFuvYFKtmit/0OiJtV2NqnYyKPRO2vIWiARUIW0C AKfA72Lb8WV8JwI+/R55onoGLjKUNfrG3Dz9NECaW+H4W7A7svs6Av1syFov5cjKOTVM ewrQ/RPXKYlRDddHzPDTtliX+kXQRjWkrobNtyekGPRlH77MZp0mqzHcYxp8pdnjefBl a7fg== X-Gm-Message-State: AOAM531tWrLuyv1dZVkJvChTf92EQZWFCbxFgigsR1ioJMX4qg49C/ks 3Q32DHoKXQCFK2wsqjXQoFbvCWphQgk= X-Google-Smtp-Source: ABdhPJyV36iaywxWIV/mu3YvgglKzrKpoYNKBcoCDN/RAIPDuOGaBX4rgSXqnIM75wkiVz9su31jZU9lMZQ= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:200:79c1:8a4c:5d17:670f]) (user=surenb job=sendgmr) by 2002:a81:1093:0:b0:2d7:2439:6279 with SMTP id 141-20020a811093000000b002d724396279mr10598421ywq.520.1645508435012; Mon, 21 Feb 2022 21:40:35 -0800 (PST) Date: Mon, 21 Feb 2022 21:40:25 -0800 In-Reply-To: <20220222054025.3412898-1-surenb@google.com> Message-Id: <20220222054025.3412898-3-surenb@google.com> Mime-Version: 1.0 References: <20220222054025.3412898-1-surenb@google.com> X-Mailer: git-send-email 2.35.1.473.g83b2b277ed-goog Subject: [PATCH v4 3/3] mm: fix use-after-free when anon vma name is used after vma is freed From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: ccross@google.com, sumit.semwal@linaro.org, mhocko@suse.com, dave.hansen@intel.com, keescook@chromium.org, willy@infradead.org, kirill.shutemov@linux.intel.com, vbabka@suse.cz, hannes@cmpxchg.org, ebiederm@xmission.com, brauner@kernel.org, legion@kernel.org, ran.xiaokai@zte.com.cn, sashal@kernel.org, chris.hyser@oracle.com, dave@stgolabs.net, pcc@google.com, caoxiaofeng@yulong.com, david@redhat.com, gorcunov@gmail.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, surenb@google.com, syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 9A5C0100004 X-Rspam-User: Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=IKHOwo4D; spf=pass (imf14.hostedemail.com: domain of 3U3cUYgYKCKocebOXLQYYQVO.MYWVSXeh-WWUfKMU.YbQ@flex--surenb.bounces.google.com designates 209.85.128.201 as permitted sender) smtp.mailfrom=3U3cUYgYKCKocebOXLQYYQVO.MYWVSXeh-WWUfKMU.YbQ@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com X-Stat-Signature: dmre7ez8u3d4dnqiyr6cxr46jisbjbs9 X-HE-Tag: 1645508435-853572 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When adjacent vmas are being merged it can result in the vma that was originally passed to madvise_update_vma being destroyed. In the current implementation, the name parameter passed to madvise_update_vma points directly to vma->anon_name->name and it is used after the call to vma_merge. In the cases when vma_merge merges the original vma and destroys it, this will result in use-after-free bug as shown below: madvise_vma_behavior << passes vma->anon_name->name as name param madvise_update_vma(name) vma_merge __vma_adjust vm_area_free <-- frees the vma replace_vma_anon_name(name) <-- UAF Fix this by raising the name refcount and stabilizing it. Fixes: 9a10064f5625 ("mm: add a field to store names for private anonymous memory") Signed-off-by: Suren Baghdasaryan Reported-by: syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com --- changes in v3: - Reapplied the fix after code refactoring, per Michal Hocko mm/madvise.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/mm/madvise.c b/mm/madvise.c index a395884aeecb..00e8105430e9 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -140,6 +140,8 @@ static int replace_vma_anon_name(struct vm_area_struct *vma, /* * Update the vm_flags on region of a vma, splitting it or merging it as * necessary. Must be called with mmap_sem held for writing; + * Caller should ensure anon_name stability by raising its refcount even when + * anon_name belongs to a valid vma because this function might free that vma. */ static int madvise_update_vma(struct vm_area_struct *vma, struct vm_area_struct **prev, unsigned long start, @@ -1021,8 +1023,10 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, } anon_name = vma_anon_name(vma); + anon_vma_name_get(anon_name); error = madvise_update_vma(vma, prev, start, end, new_flags, anon_name); + anon_vma_name_put(anon_name); out: /*