FAILED: patch "[PATCH] mm: lock_vma_under_rcu() must check vma->anon_vma under vma" failed to apply to 6.4-stable tree
Subsystems (3)
[email protected]
maintainerThe patch below does not apply to the 6.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.4.y
git checkout FETCH_HEAD
git cherry-pick -x 657b5146955eba331e01b9a6ae89ce2e716ba306
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2023080129-surface-stench-5e24@gregkh' --subject-prefix 'PATCH 6.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 657b5146955eba331e01b9a6ae89ce2e716ba306 Mon Sep 17 00:00:00 2001
From: Jann Horn <[email protected]>
Date: Wed, 26 Jul 2023 23:41:03 +0200
Subject: [PATCH] mm: lock_vma_under_rcu() must check vma->anon_vma under vma
lock
lock_vma_under_rcu() tries to guarantee that __anon_vma_prepare() can't be called in the VMA-locked page fault path by ensuring that vma->anon_vma is set.
However, this check happens before the VMA is locked, which means a concurrent move_vma() can concurrently call unlink_anon_vmas(), which disassociates the VMA's anon_vma.
This means we can get UAF in the following scenario:
THREAD 1 THREAD 2
======== ========
<page fault>
lock_vma_under_rcu()
rcu_read_lock()
mas_walk()
check vma->anon_vma
mremap() syscall
move_vma()
vma_start_write()
unlink_anon_vmas()
<syscall end>
handle_mm_fault()
__handle_mm_fault()
handle_pte_fault()
do_pte_missing()
do_anonymous_page()
anon_vma_prepare()
__anon_vma_prepare()
find_mergeable_anon_vma()
mas_walk() [looks up VMA X]
munmap() syscall (deletes VMA X)
reusable_anon_vma() [called on freed VMA X]This is a security bug if you can hit it, although an attacker would have to win two races at once where the first race window is only a few instructions wide.
This patch is based on some previous discussion with Linus Torvalds on the security list.
mm/memory.c +16 -12
@@ -5393,27 +5393,28 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,if (!vma_is_anonymous (vma) && !vma_is_tcp (vma)) goto inval; -/* find_mergeable_anon_vma uses adjacent vmas which are not locked */ -if (!vma->anon_vma && !vma_is_tcp (vma)) - goto inval; -if (!vma_start_read (vma)) goto inval; +/* +* find_mergeable_anon_vma uses adjacent vmas which are not locked. +* This check must happen after vma_start_read(); otherwise, a +* concurrent mremap() with MREMAP_DONTUNMAP could dissociate the VMA +* from its anon_vma. +*/ +if (unlikely (!vma->anon_vma && !vma_is_tcp (vma))) + goto inval_end_read; +/* * Due to the possibility of userfault handler dropping mmap_lock, avoid * it for now and fall back to page fault handling under mmap_lock. */ -if (userfaultfd_armed (vma)) { -vma_end_read (vma); - goto inval; - } +if (userfaultfd_armed (vma)) + goto inval_end_read;/* Check since vm_start/vm_end might change before we lock the VMA */ -if (unlikely (address < vma->vm_start || address >= vma->vm_end)) { -vma_end_read (vma); - goto inval; - } +if (unlikely (address < vma->vm_start || address >= vma->vm_end)) + goto inval_end_read;/* Check if the VMA got isolated after we found it */ if (vma->detached) {
@@ -5425,6 +5426,9 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,rcu_read_unlock ();return vma; + +inval_end_read: +vma_end_read (vma); inval:rcu_read_unlock ();count_vm_vma_lock_event (VMA_LOCK_ABORT );
Quoted 2 lines · On Mon, 31 Jul 2023 at 23:28, <[email protected]> wrote:
The patch below does not apply to the 6.4-stable tree.
Ahh. The vma_is_tcp() checks are new.
I think you can literally just remove all occurrences of
&& !vma_is_tcp(vma)
in that patch to make it apply.
The end result should look something like the attached, afaik.
Linus
mm/memory.c +16 -12
@@ -5284,27 +5284,28 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,if (!vma_is_anonymous (vma)) goto inval; -/* find_mergeable_anon_vma uses adjacent vmas which are not locked */ -if (!vma->anon_vma) - goto inval; -if (!vma_start_read (vma)) goto inval; +/* +* find_mergeable_anon_vma uses adjacent vmas which are not locked. +* This check must happen after vma_start_read(); otherwise, a +* concurrent mremap() with MREMAP_DONTUNMAP could dissociate the VMA +* from its anon_vma. +*/ +if (unlikely (!vma->anon_vma)) + goto inval_end_read; +/* * Due to the possibility of userfault handler dropping mmap_lock, avoid * it for now and fall back to page fault handling under mmap_lock. */ -if (userfaultfd_armed (vma)) { -vma_end_read (vma); - goto inval; - } +if (userfaultfd_armed (vma)) + goto inval_end_read;/* Check since vm_start/vm_end might change before we lock the VMA */ -if (unlikely (address < vma->vm_start || address >= vma->vm_end)) { -vma_end_read (vma); - goto inval; - } +if (unlikely (address < vma->vm_start || address >= vma->vm_end)) + goto inval_end_read;/* Check if the VMA got isolated after we found it */ if (vma->detached) {
@@ -5316,6 +5317,9 @@ struct vm_area_struct *lock_vma_under_rcu(struct mm_struct *mm,rcu_read_unlock ();return vma; + +inval_end_read: +vma_end_read (vma); inval:rcu_read_unlock ();count_vm_vma_lock_event (VMA_LOCK_ABORT );
Greg KH
maintainerQuoted 6 lines · Linus Torvalds
Quoted 2 lines · On Mon, 31 Jul 2023 at 23:28, <[email protected]> wrote:
The patch below does not apply to the 6.4-stable tree.
Ahh. The
vma_is_tcp()checks are new.
Quoted 7 lines
I think you can literally just remove all occurrences of
&& !vma_is_tcp(vma)in that patch to make it apply.
The end result should look something like the attached, afaik.
Thanks, that worked, now queued up.
greg k-h