lkml.org 
[lkml]   [2022]   [Aug]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 4/6] mm, hwpoison: fix possible use-after-free in mf_dax_kill_procs()
    Date
    On Thu, Aug 18, 2022 at 09:00:14PM +0800, Miaohe Lin wrote:
    > After kill_procs(), tk will be freed without being removed from the to_kill
    > list. In the next iteration, the freed list entry in the to_kill list will
    > be accessed, thus leading to use-after-free issue.

    kill_procs() runs over the to_kill list and frees all listed items in each
    iteration. So just after returning from unmap_and_kill(), to_kill->next and
    to_kill->prev still point to the addresses of struct to_kill which was the
    first or last item (already freed!). This is bad-manered, but
    collect_procs_fsdax() in the next iteration calls list_add_tail() and
    overwrites the dangling pointers with newly allocated item. So this problem
    should not be so critical? Anyway, I agree with fixing this fragile code.

    > Fix it by reinitializing
    > the to_kill list after unmap_and_kill().
    >
    > Fixes: c36e20249571 ("mm: introduce mf_dax_kill_procs() for fsdax case")
    > Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>

    > ---
    > mm/memory-failure.c | 2 ++
    > 1 file changed, 2 insertions(+)
    >
    > diff --git a/mm/memory-failure.c b/mm/memory-failure.c
    > index 7023c3d81273..a2f4e8b00a26 100644
    > --- a/mm/memory-failure.c
    > +++ b/mm/memory-failure.c
    > @@ -1658,6 +1658,8 @@ int mf_dax_kill_procs(struct address_space *mapping, pgoff_t index,
    > collect_procs_fsdax(page, mapping, index, &to_kill);
    > unmap_and_kill(&to_kill, page_to_pfn(page), mapping,
    > index, mf_flags);
    > + /* Reinitialize to_kill list for later resuing. */

    s/resuing/reusing/ ?

    > + INIT_LIST_HEAD(&to_kill);

    How about adding list_del() in kill_procs()? Other callers now use
    to_kill only once, but fixing generally looks tidier to me.

    Thanks,
    Naoya Horiguchi
    \
     
     \ /
      Last update: 2022-08-19 07:27    [W:2.692 / U:0.244 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site