lkml.org 
[lkml]   [2022]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] mm: hugetlb: fix UAF in hugetlb_handle_userfault
From
Date


On 2022/9/22 3:07, Andrew Morton wrote:
> On Wed, 21 Sep 2022 16:34:40 +0800 Liu Shixin <liushixin2@huawei.com> wrote:
>
>> The vma_lock and hugetlb_fault_mutex are dropped before handling
>> userfault and reacquire them again after handle_userfault(), but
>> reacquire the vma_lock could lead to UAF[1] due to the following
>> race,
>>
>> hugetlb_fault
>> hugetlb_no_page
>> /*unlock vma_lock */
>> hugetlb_handle_userfault
>> handle_userfault
>> /* unlock mm->mmap_lock*/
>> vm_mmap_pgoff
>> do_mmap
>> mmap_region
>> munmap_vma_range
>> /* clean old vma */
>> /* lock vma_lock again <--- UAF */
>> /* unlock vma_lock */
>>
>> Since the vma_lock will unlock immediately after hugetlb_handle_userfault(),
>> let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix
>> the issue.
>>
>> @@ -5508,17 +5507,12 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma,
>>
>> /*
>> * vma_lock and hugetlb_fault_mutex must be
>> - * dropped before handling userfault. Reacquire
>> - * after handling fault to make calling code simpler.
>> + * dropped before handling userfault.
>> */
>> hugetlb_vma_unlock_read(vma);
>> hash = hugetlb_fault_mutex_hash(mapping, idx);
>> mutex_unlock(&hugetlb_fault_mutex_table[hash]);
>> - ret = handle_userfault(&vmf, reason);
>> - mutex_lock(&hugetlb_fault_mutex_table[hash]);
>> - hugetlb_vma_lock_read(vma);
>> -
>> - return ret;
>> + return handle_userfault(&vmf, reason);
>> }
> Current code is rather different from this. So if the bug still exists
> in current code, please verify this and redo the patch appropriately?
>
> And hang on to this version to help with the -stable backporting.
>
> Thanks.
> .
This patch conflicts with patch series "hugetlb: Use new vma lock for huge pmd sharing synchronization".
So I reproduce the problem on next-20220920 and this patch is based on next-20220920 instead of mainline.
This problem is existed since v4.11. I will send the stable version later.

\
 
 \ /
  Last update: 2022-09-22 03:59    [W:0.083 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site