From patchwork Wed Feb 23 15:36:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Suren Baghdasaryan X-Patchwork-Id: 12757090 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71EB8C433F5 for ; Wed, 23 Feb 2022 15:36:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0AC068D001C; Wed, 23 Feb 2022 10:36:25 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 05CBC8D0011; Wed, 23 Feb 2022 10:36:25 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E68AE8D001C; Wed, 23 Feb 2022 10:36:24 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0101.hostedemail.com [216.40.44.101]) by kanga.kvack.org (Postfix) with ESMTP id C29028D0011 for ; Wed, 23 Feb 2022 10:36:24 -0500 (EST) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 597918248D52 for ; Wed, 23 Feb 2022 15:36:24 +0000 (UTC) X-FDA: 79174446288.15.B9465D3 Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) by imf18.hostedemail.com (Postfix) with ESMTP id CD69C1C0009 for ; Wed, 23 Feb 2022 15:36:23 +0000 (UTC) Received: by mail-yb1-f201.google.com with SMTP id s22-20020a252d56000000b00624652ac3e1so12372568ybe.16 for ; Wed, 23 Feb 2022 07:36:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=KVI9h34IVpEZB73JFOBMLmYxwNU0WUD9iiOxc47ibAs=; b=cEOaTS6V3ulJlRkWpGLZufC1eh2PraLWoGncZISKjYg572ZFmQbI5VgWAZ6KyfvVgB +piaGLu69caHkbCzLMLInrkAWMBlCc3sY2U385t5PYrlH7CrDziPpdt4xbhanGJ1zc/a 64pBgl9gpq3C6uLvx+Fwi0cbxm9kCb4cUqQF5+DsBoDFU+mj/McXhoongC8mkEYf33z1 kw6l9/F9DIW2LMZsrgZ9qaXvuWQxDxKuyOKvNTO25CCAdaQ7jfRi8oi6pjMg93VLCzOv oPHphG2/cnq/AMLn51ciMFK6Ctr1gR5AUA4tTkrBxg1XmcPLXf4DrWJVpXv7fDNfmdYN UnFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=KVI9h34IVpEZB73JFOBMLmYxwNU0WUD9iiOxc47ibAs=; b=AgfTyOZfKPM3mKO/+45JUXWPFUdmf85zkEXiC1wDhNrJEqyV35P7JZq/xUYZqmADF0 6PRSxidY36vSXZn8idbRT/e/EGpegeb+o/gYpGJY/1rEWsgdogyypZuS8PGSN21WOOXJ 1pMPyZMmJzLXDOC826qrUPVwShOAV4g393iQmKjLC+yGo+Vg0QbK9tRG3v6Erhb1/Vhf t6QNwWZsUwnsjuVsetJNLVOiOGSP+gpMhd6ShLiudre6gHtrzzzuQNcKRN0vP5n1BWeb qu5E8d125y4c+yL7EpT3vbqLRLkJhZiNPMIVIwPwoe7xS68MppNThVrqMUYUPvfO5B8i kHVg== X-Gm-Message-State: AOAM532VUY06/dUOmt9vPppVihp10ekzu9AlcIBwphNFNB4EK/cyLztn yf0LnkTZWy2+JuIwHW5b24Uh9eCk2+0= X-Google-Smtp-Source: ABdhPJz+dH+QYp21E0/NCb1xG1S5CJgsvwNt+rRWPe/zdfkulvwJe0FdspODecQRD2+y/VFn8M2ELMl3+IY= X-Received: from surenb-desktop.mtv.corp.google.com ([2620:15c:211:200:5093:9fb5:d0ba:a5f]) (user=surenb job=sendgmr) by 2002:a25:2e10:0:b0:624:72a4:d938 with SMTP id u16-20020a252e10000000b0062472a4d938mr250689ybu.559.1645630582756; Wed, 23 Feb 2022 07:36:22 -0800 (PST) Date: Wed, 23 Feb 2022 07:36:13 -0800 In-Reply-To: <20220223153613.835563-1-surenb@google.com> Message-Id: <20220223153613.835563-3-surenb@google.com> Mime-Version: 1.0 References: <20220223153613.835563-1-surenb@google.com> X-Mailer: git-send-email 2.35.1.473.g83b2b277ed-goog Subject: [PATCH v5 3/3] mm: fix use-after-free when anon vma name is used after vma is freed From: Suren Baghdasaryan To: akpm@linux-foundation.org Cc: ccross@google.com, sumit.semwal@linaro.org, mhocko@suse.com, dave.hansen@intel.com, keescook@chromium.org, willy@infradead.org, kirill.shutemov@linux.intel.com, vbabka@suse.cz, hannes@cmpxchg.org, ebiederm@xmission.com, brauner@kernel.org, legion@kernel.org, ran.xiaokai@zte.com.cn, sashal@kernel.org, chris.hyser@oracle.com, dave@stgolabs.net, pcc@google.com, caoxiaofeng@yulong.com, david@redhat.com, gorcunov@gmail.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-team@android.com, surenb@google.com, syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com X-Stat-Signature: itcec638ypyxddm4uzarihohwmcftp9y X-Rspam-User: Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=cEOaTS6V; spf=pass (imf18.hostedemail.com: domain of 3dlQWYgYKCI8BDAx6uz77z4x.v75416DG-553Etv3.7Az@flex--surenb.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=3dlQWYgYKCI8BDAx6uz77z4x.v75416DG-553Etv3.7Az@flex--surenb.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: CD69C1C0009 X-HE-Tag: 1645630583-298980 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When adjacent vmas are being merged it can result in the vma that was originally passed to madvise_update_vma being destroyed. In the current implementation, the name parameter passed to madvise_update_vma points directly to vma->anon_name and it is used after the call to vma_merge. In the cases when vma_merge merges the original vma and destroys it, this will result in use-after-free bug as shown below: madvise_vma_behavior(vma) madvise_update_vma(vma, ..., anon_name == vma->anon_name) vma_merge(vma) __vma_adjust(vma) <-- merges vma with adjacent one vm_area_free(vma) <-- frees the original vma replace_vma_anon_name(anon_name) <-- UAF of vma->anon_name Fix this by raising the name refcount and stabilizing it. Fixes: 9a10064f5625 ("mm: add a field to store names for private anonymous memory") Signed-off-by: Suren Baghdasaryan Reported-by: syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com Acked-by: Michal Hocko --- changes in v5: - Updated description, per Michal Hocko mm/madvise.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mm/madvise.c b/mm/madvise.c index 1f2693dccf7b..38d0f515d548 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -131,6 +131,8 @@ static int replace_anon_vma_name(struct vm_area_struct *vma, /* * Update the vm_flags on region of a vma, splitting it or merging it as * necessary. Must be called with mmap_sem held for writing; + * Caller should ensure anon_name stability by raising its refcount even when + * anon_name belongs to a valid vma because this function might free that vma. */ static int madvise_update_vma(struct vm_area_struct *vma, struct vm_area_struct **prev, unsigned long start, @@ -945,6 +947,7 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, unsigned long behavior) { int error; + struct anon_vma_name *anon_name; unsigned long new_flags = vma->vm_flags; switch (behavior) { @@ -1010,8 +1013,11 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, break; } + anon_name = anon_vma_name(vma); + anon_vma_name_get(anon_name); error = madvise_update_vma(vma, prev, start, end, new_flags, - anon_vma_name(vma)); + anon_name); + anon_vma_name_put(anon_name); out: /*