uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails
Subsystems (5)
cover uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails
Hello.
I guess this patch was forgotten due to the lengthy discussion, see http://marc.info/?t=134349366100001
I am re-sending it because it fixes the serious and easy-to-trigger problem. Just do something like
# echo "p /bin/true:OFFSET_OF_INVALID_INSN" > tracing/uprobe_events # /bin/true
to crash the kernel. I think this is 3.6/stable material, the patch is simple and obviously can't make any harm.
Just in case... Yes, this is not what we want in the long term, but there is no simple fix for now and we need other changes in uprobe.c before we can teach mmap_region() to handle the error from uprobe_mmap().
Oleg.
cover uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails
https://bugzilla.redhat.com/show_bug.cgi?id=843640
If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree. Actually there are more problems but this is how William noticed this bug.
Perhaps we could do do_munmap() + return in this case, but in fact it is simply wrong to abort if uprobe_mmap() fails. Until at least we move the !UPROBE_COPY_INSN code from install_breakpoint() to uprobe_register().
For example, uprobe_mmap()->install_breakpoint() can fail if the probed insn is not supported (remember, uprobe_register() succeeds if nobody mmaps inode/offset), mmap() should not fail in this case.
dup_mmap()->uprobe_mmap() is wrong too by the same reason, fork() can race with uprobe_register() and fail for no reason if it wins the race and does install_breakpoint() first.
And, if nothing else, both mmap_region() and dup_mmap() return success if uprobe_mmap() fails. Change them to ignore the error code from uprobe_mmap().
--- kernel/fork.c | 4 ++-- mm/mmap.c | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)
kernel/fork.c +2 -2
@@ -454,8 +454,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)if (retval) goto out; -if (file &&uprobe_mmap (tmp)) - goto out; +if (file) +uprobe_mmap (tmp); }/* a new mm has just been created */ arch_dup_mmap (oldmm, mm);
mm/mmap.c +2 -3
@@ -1355,9 +1355,8 @@ out: }else if ((flags &MAP_POPULATE ) && !(flags &MAP_NONBLOCK ))make_pages_present (addr, addr + len); -if (file &&uprobe_mmap (vma)) -/* matching probes but cannot insert */ - goto unmap_and_free_vma; +if (file) +uprobe_mmap (vma);return addr;
Signature · 1 line
1.5.5.1
OOPS, sorry, wrong subject. Ignore this email, see the next one.
Quoted 68 lines · Oleg Nesterov
https://bugzilla.redhat.com/show_bug.cgi?id=843640
If mmap_region()->uprobe_mmap() fails,
unmap_and_free_vmapath doesunmap_region()but does not remove the soon-to-be-freed vma from rb tree. Actually there are more problems but this is how William noticed this bug.Perhaps we could do
do_munmap()+ return in this case, but in fact it is simply wrong to abort ifuprobe_mmap()fails. Until at least we move the !UPROBE_COPY_INSN code frominstall_breakpoint()touprobe_register().For example, uprobe_mmap()->install_breakpoint() can fail if the probed insn is not supported (remember,
uprobe_register()succeeds if nobody mmaps inode/offset),mmap()should not fail in this case.dup_mmap()->uprobe_mmap() is wrong too by the same reason,
fork()can race withuprobe_register()and fail for no reason if it wins the race and doesinstall_breakpoint()first.And, if nothing else, both
mmap_region()anddup_mmap()return success ifuprobe_mmap()fails. Change them to ignore the error code fromuprobe_mmap().Reported-and-tested-by William Cohen <[email protected]>Signed-off-by Oleg Nesterov <[email protected]>Cc <[email protected]> # v3.5--- kernel/fork.c | 4 ++-- mm/mmap.c | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)kernel/fork.c +2
-2@@ -454,8 +454,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)if (retval) goto out; -if (file &&uprobe_mmap (tmp)) - goto out; +if (file) +uprobe_mmap (tmp); }/* a new mm has just been created */ arch_dup_mmap (oldmm, mm);mm/mmap.c +2
-4@@ -1355,9 +1355,8 @@ out: }else if ((flags &MAP_POPULATE ) && !(flags &MAP_NONBLOCK ))make_pages_present (addr, addr + len); -if (file &&uprobe_mmap (vma)) -/* matching probes but cannot insert */ - goto unmap_and_free_vma; +if (file) +uprobe_mmap (vma);return addr; --1.5.5.1
PATCH 1/1 uprobes: mmap_region() corrupts mm->mm_rb if uprobe_mmap() fails
In reply to Oleg Nesterovhttps://bugzilla.redhat.com/show_bug.cgi?id=843640
If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree. Actually there are more problems but this is how William noticed this bug.
Perhaps we could do do_munmap() + return in this case, but in fact it is simply wrong to abort if uprobe_mmap() fails. Until at least we move the !UPROBE_COPY_INSN code from install_breakpoint() to uprobe_register().
For example, uprobe_mmap()->install_breakpoint() can fail if the probed insn is not supported (remember, uprobe_register() succeeds if nobody mmaps inode/offset), mmap() should not fail in this case.
dup_mmap()->uprobe_mmap() is wrong too by the same reason, fork() can race with uprobe_register() and fail for no reason if it wins the race and does install_breakpoint() first.
And, if nothing else, both mmap_region() and dup_mmap() return success if uprobe_mmap() fails. Change them to ignore the error code from uprobe_mmap().
--- kernel/fork.c | 4 ++-- mm/mmap.c | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)
kernel/fork.c +2 -2
@@ -454,8 +454,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)if (retval) goto out; -if (file &&uprobe_mmap (tmp)) - goto out; +if (file) +uprobe_mmap (tmp); }/* a new mm has just been created */ arch_dup_mmap (oldmm, mm);
mm/mmap.c +2 -3
@@ -1355,9 +1355,8 @@ out: }else if ((flags &MAP_POPULATE ) && !(flags &MAP_NONBLOCK ))make_pages_present (addr, addr + len); -if (file &&uprobe_mmap (vma)) -/* matching probes but cannot insert */ - goto unmap_and_free_vma; +if (file) +uprobe_mmap (vma);return addr;
Signature · 1 line
1.5.5.1
[tip:perf/urgent] uprobes: Fix mmap_region()'s mm-> mm_rb corruption if uprobe_mmap() fails
Commit-ID: c7a3a88c938fbe3d70c2278e082b80eb830d1c58 Gitweb: http://git.kernel.org/tip/c7a3a88c938fbe3d70c2278e082b80eb830d1c58 Author: Oleg Nesterov <[email protected]> AuthorDate: Sun, 19 Aug 2012 19:10:42 +0200 Committer: Ingo Molnar <[email protected]> CommitDate: Tue, 21 Aug 2012 11:48:12 +0200
uprobes: Fix mmap_region()'s mm->mm_rb corruption if uprobe_mmap() fails
This patch fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=843640
If mmap_region()->uprobe_mmap() fails, unmap_and_free_vma path does unmap_region() but does not remove the soon-to-be-freed vma from rb tree. Actually there are more problems but this is how William noticed this bug.
Perhaps we could do do_munmap() + return in this case, but in fact it is simply wrong to abort if uprobe_mmap() fails. Until at least we move the !UPROBE_COPY_INSN code from install_breakpoint() to uprobe_register().
For example, uprobe_mmap()->install_breakpoint() can fail if the probed insn is not supported (remember, uprobe_register() succeeds if nobody mmaps inode/offset), mmap() should not fail in this case.
dup_mmap()->uprobe_mmap() is wrong too by the same reason, fork() can race with uprobe_register() and fail for no reason if it wins the race and does install_breakpoint() first.
And, if nothing else, both mmap_region() and dup_mmap() return success if uprobe_mmap() fails. Change them to ignore the error code from uprobe_mmap().
--- kernel/fork.c | 4 ++-- mm/mmap.c | 5 ++--- 2 files changed, 4 insertions(+), 5 deletions(-)
kernel/fork.c +2 -2
@@ -455,8 +455,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)if (retval) goto out; -if (file &&uprobe_mmap (tmp)) - goto out; +if (file) +uprobe_mmap (tmp); }/* a new mm has just been created */ arch_dup_mmap (oldmm, mm);
mm/mmap.c +2 -3
@@ -1356,9 +1356,8 @@ out: }else if ((flags &MAP_POPULATE ) && !(flags &MAP_NONBLOCK ))make_pages_present (addr, addr + len); -if (file &&uprobe_mmap (vma)) -/* matching probes but cannot insert */ - goto unmap_and_free_vma; +if (file) +uprobe_mmap (vma);return addr;