From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935749AbcHaQQk (ORCPT ); Wed, 31 Aug 2016 12:16:40 -0400 Received: from mail-db5eur01on0139.outbound.protection.outlook.com ([104.47.2.139]:41504 "EHLO EUR01-DB5-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S935553AbcHaQPs (ORCPT ); Wed, 31 Aug 2016 12:15:48 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; Subject: Re: [patch 04/12] stackdepot: fix mempolicy use-after-free To: David Rientjes , Vegard Nossum References: <57bf6e56.oTFKip6ell2mR8QO%akpm@linux-foundation.org> <6d86e953-2162-d9d6-4c7b-69d806b7b8b3@virtuozzo.com> CC: , , , , , LKML From: Andrey Ryabinin Message-ID: <88a5fe48-fa84-13e8-4787-7bfbc898fe4e@virtuozzo.com> Date: Wed, 31 Aug 2016 19:16:44 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM5PR0901CA0006.eurprd09.prod.outlook.com (10.164.186.144) To VI1PR0802MB2560.eurprd08.prod.outlook.com (10.172.255.138) X-MS-Office365-Filtering-Correlation-Id: 9b608be6-5367-4f7e-7338-08d3d1ba00f7 X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2560;2:6G1qj67yJqs7ijiqD4PNBpXtlDVk2tDg5Ttcq/0h8eWm3IU6ZIIUV0m1wvylRAG9dCvTd0nLRG15DvotBFaDlSfh2yZ7Wd8Nw620ejo/61ANDzeGwC2tnKA8CkK1LogDqfXnu8+4HikRiH24PO0cymAnzSowqrhnH5elq3Jv3F3QZ+4i/2vSLkJ036IXX5zN;3:LuRzAFsFOGK3qR/EhbhjUQXlKXo3tsu0TPHybvyeqS6yhe+CbvYEnehzuy3XQT80yHkK8orsNVmaCvJKCDRBlufHLmY/+TUaepQKRUnXk26WtVuLRz15TMVRQ0zaR51L;25:BF6z/is3RMVw2Avajl9vJAax0DJu7iKH5bOLWt5315b3KLHjhFnqOSXOwaUt2Kd5USdwULo9s3GP0Fcecoymjfj1zCpBMT6jbxCPPRwClWGvHM19JnrhKDuJXkGchFXfH07GLV1R+Qycn6jcHxeBHLPq7x9tPWTOOWE50LvFCx2rEC+UQcXC+yx0EsrP4wpOi5AFSHNpXjQGlvQt6Ac2zCxl+MxAZd4PPaInsJYjwGHErYACgSf6fjloS6+iqPMrnWZHjowKvEyLx1J3U3kfKlGIt8lDwIZUAGGDGA1OV6pGg2NfeBNP6nyouIxR6WA/s5qlDDWj+SD6biRCVfXLtEmq/j9LCx5+dRn16Zm3AFU+xcM5Ai5n8jZf0VqOww+I0B1Ve2Zl5Vv94giTCMn4Ipk2T0sNgeM+tcjSRU5V8UQ= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0802MB2560; X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2560;31:k/3SMbWUI+Pqto5xc5JixpOQ6Xc4zlI3Rq6YtV2RKN05PYAWtcur/sSmYEmprS1S+h88oKSKkcO6RrHlmx+IB9eYnGyis2VCznLo8lHzfaF0XT4Bqzytfvef0JwFWrG7u4L/LZto852CksxwmYP1XBbqSvn2PPA9v94RuvFL/PWq6iu/Yu4FiZr8vdujdgWNph6ve8ma5XoCKS7RHBTRkUKlGjeji8DbOaOEku7f2jM=;4:x4pdhIHzt6G17k7JzWSUCScvfboEFRaSQFgMk9GBEfSplPSu0Q5U/qUZSaQWjbtuKd+Ba8S61dHOP/5fj7MMS7n3miLDV1E7i+55ztHzjZkn6laakJA4rFH0O9JJLLMuA1btGqEcC/vQxwTlMw3FrESmXF7VB0h6QPBdO59pMu86dW5ED27sUYU9oxxiO/cDDhxN8r0LFn6M1XyY2v5HnVtmxYr1ZNIjmm6DtsGi0dYDV1ojVWkssMGCb4hQn30pEOOH6MaOwknPUk8eVD+rpyjAx7JP2ohZZ7tdO6X3ZLDOX29UBIM9I/fovjg/rHCDxzQAINFnScnWywBd9qtFixMpPFPnhFvb5knG3OszY73JbRciklmhhVRr4vZWHYt2MUkANWcN7kh0T9tu8AfuFnk7v2a2eCpPjoquofPkJBiDBa8+5bVXAIxzbKYEviM2T/wfhXYVfZKgsNpHFwEN/3gIV4RpOJUXAr2+fFuflXmzfNgAenQvwcdho0FmUH6w X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(211936372134217)(146099531331640); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(5005006)(8121501046)(10201501046)(3002001)(6043046)(6042046);SRVR:VI1PR0802MB2560;BCL:0;PCL:0;RULEID:;SRVR:VI1PR0802MB2560; X-Forefront-PRVS: 00514A2FE6 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6049001)(6009001)(7916002)(24454002)(189002)(55674003)(199003)(377454003)(106356001)(230783001)(7846002)(76176999)(54356999)(7736002)(305945005)(31686004)(19580395003)(19580405001)(36756003)(4326007)(42186005)(65956001)(230700001)(105586002)(2906002)(2950100001)(4001350100001)(101416001)(8676002)(50466002)(81156014)(83506001)(68736007)(86362001)(64126003)(23746002)(189998001)(50986999)(586003)(65806001)(93886004)(66066001)(81166006)(5660300001)(47776003)(3846002)(33646002)(5001770100001)(31696002)(92566002)(6116002)(97736004)(77096005)(65826007);DIR:OUT;SFP:1102;SCL:1;SRVR:VI1PR0802MB2560;H:[10.30.19.223];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;VI1PR0802MB2560;23:XKHnUMcQaQyb8QXC6D9p5fS7Zyckl9r/9N5?= =?Windows-1252?Q?blKi+WA3XWqvuoW5QmZmWnMrb1aWjmnxNekkVCYt0zko1AUlfoOiUF+o?= =?Windows-1252?Q?p77TI0OIjpCdODS/ssTZAfHDJPMVNilCAQfyquYl5SgGju8N1cfuv/De?= =?Windows-1252?Q?GSo97ojXLYNRRhQoN8X/dxf1oY5K2suHbpGGn/OsFY69NuewMAc6yMzx?= =?Windows-1252?Q?TDO5Pnqtk8c0/ymjqS626oTDjB9OLEANQeXKSOkRPFXMOIaVny0JO43l?= =?Windows-1252?Q?qHurY6v+D9F3Hh610ZTOSwCl1h0/YR+LC72dl+80rQupGKIwV18qZlFq?= =?Windows-1252?Q?cUKTW6ZdgObpmi+5uZdwWjUFixx9W2KPVyTvF4/NNcPsoyjrYpcqt3C/?= =?Windows-1252?Q?bRdDC0Q3zO97PPpNmp3unrhcqqt2PEhBbBLA3KfozvBRGOntPW9Q1037?= =?Windows-1252?Q?O4UETqJJ4rrGWGb6zT/IGUnQ39fZewSiBu9KVHk4MG09fgUgKvrj+UfE?= =?Windows-1252?Q?rLEhoPeeN/O1kax4BCEOAAXc75iwsbOCrvjFYYXUg7CjsLgnAAYpBVS7?= =?Windows-1252?Q?lrJRRIf/ba78Zb5secr++q9Au80SxzTVFDjSvEvpM6mG5EcjieeogxbE?= =?Windows-1252?Q?dEIIqNss2dEWY2YaWFRgUzhc3zXsXbYPt0H3kdGGVTfLGkiEqILxTTE4?= =?Windows-1252?Q?eilkhlYBKfThE8MOXvevY4tii/KdP7UlFK5m8BK//duZ+puRx3eF1NF5?= =?Windows-1252?Q?YduAfUmmuy+6bB5Y2KdNT5CWFqLs65DmTtRtcQZSh+9LmgD7HXCJjmhE?= =?Windows-1252?Q?nAFWDcfmByn87biiKjA53UIdUVomc4M+NtKtlAdKiSEu068Sr97IBOZ0?= =?Windows-1252?Q?oU1g19QHHpSWK4Mv8XWmlrALaXFVIGDMbn3JT2rCp9v8kOjhgNtAlN1d?= =?Windows-1252?Q?/g+7gxvYuFkMaswba4jMhrZdTDtsEo1iFwH6vJ1/1J9Wfzaw6LbbXMaB?= =?Windows-1252?Q?8NL+X//4y+gjVazXySRbgEPSvOkmSQta4POFO/cUI5It5S+pm7jZNPOx?= =?Windows-1252?Q?BeeJCoyoEwjKT/Bzjl20Zw+vY8LKmrbjT5nBT4/GME5neKhbPcAGvmXi?= =?Windows-1252?Q?xoEe6TBevovLbIrg9FTBX0d4m6rzDpk8k90EatrrH+Z5FT9HNPSqEzIz?= =?Windows-1252?Q?WLbvbn3hNFKQwEx9plUbYu1+hQgdcen5piOdXhmbSKDN5P/nr32mKHOJ?= =?Windows-1252?Q?+xM0u9+ztZNt/d1NVpdtYtLrnd6kTO4uAnXL0iKg2fxQqBjXyQOL7TrL?= =?Windows-1252?Q?1fsuPoOvk2D8BMuEDfesIUA6VN+MTTMt9TomRc42EHxPoRRMW+jNsZd9?= =?Windows-1252?Q?Qq0+600yxON3+AVVoa7IbvAQ0awCXosfsni7Zb6V1BMuMpZIRShIcyIT?= =?Windows-1252?Q?OGhu9kxtVF+/qxtnv3Z+KxYdPUdzrs3cMrUDmyqpqReJD8Sv25+LZiRh?= =?Windows-1252?Q?OcQ8qTzc=3D?= X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2560;6:7hTbwb37fMZ5tIHXg9wbNh6PeU+8Jrfun4g/Leicqw3nXfig05MO2p29VZTZe6Zu5b1Vl6bYYldRt+fLGWINjXjUiR/PojEoyD1tC5JEOWWkizeKSgNZ3XsOK/AeUyrEHlgCg7k+Ep4PDRbLYElY01MlbOGRSzocROMJeVrIDzUYUbwKS7n84+yESIgxn3pRLG2Eq6e76cuJ7bPRtwgBWJakMepD5pnEDJdl2rhM/0pbZx0VBGTKUzMziCKFYHlKFUBKqi2xLEDkVzJTv+0yYPUzrqGtenjjdgduaMQYzikgWiVEYUYyovYpK7eA5AyK;5:hbLHEltwygmFmex+7B7Uw8Dp7ZWm2OxaMJ5siHSCt2BNXUowvgWQRsF/Xazj4rQJjgb8qaAOLE0k6i5AQOgn0dAor3z+7J9DYMd0S8KzRRJTr2sciekW+rv5OZki54s2M1Lo7V+/nfYy4nxPxC7x+w==;24:kdB/CUXnQNDxHf5qHfH7OBAuPyL8jpgMf6rBahS4wMWOMGD/84Rvg0NyuMHruWWA2kzwV5a1PCCIAfAsdh7fhVe2Nukr77QCjBJoF0xa2OI=;7:ODvwi1OWKdDE42zr6x4bTSPeZldmWkZ/fr+w41eKH4mn7yWfw+XyybHBNZKsNegJ3M4fg8NIpBMlMr/NBxZmguChU4z8FOO//ZO1aF7ub0hV0FhKjd+LA/PiYN7F7BXWC2rIjROWXAq41XbS97tHQ4aeACPkxRGZBUlMOLlsH5DLXrWIxqIQ3bys250XU1JS7vkyF07sq7QLAVnVJtKi92f/sRLSwsB52KVi6bNktfNpKXXw15ULuia5xZ7/MWvS SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;VI1PR0802MB2560;20:UiPmRuYBaj5wyrMIxUkzvYISEKBMl13WhGS2BiEMlcX339Hz4y6MXhwhZuG8tEK/qt1v48ufydBpd/rgnDVat0U4v2WlDZF2SFkFObfbObihdZJ2PJ6Q7GhksfSP/sHq/f7wms7OEkJypPJjwZoDANM0+/WidM/qmMN1wJ+p2hE= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 Aug 2016 16:15:19.2845 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0802MB2560 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/31/2016 12:52 AM, David Rientjes wrote: > On Fri, 26 Aug 2016, Vegard Nossum wrote: > [...] >> >> If nobody beats me to it, I can submit a new patch. The reason I haven't >> submitted it just yet is because I want a chance to test that I get it >> right and that the bug goes away. In the meantime this patch does fix a >> bug that I ran into frequently. I don't think the patch above is total >> crap. >> > > What we want to do is stash away current->mempolicy, do > current->mempolicy = NULL so functions like alloc_pages() don't look at > it, and then do mpol_put() on it. task_unlock() acts a memory barrier in > this case, lib/stackdepot.c needs no change. > > I think we need this backported to stable for 4.5+. > 4.6+, as this fixes: cd11016e5f52 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB") $ git describe --contains cd11016e5f5212c v4.6-rc1~6^2~4 > Whaddyathink? > Acked-by: Andrey Ryabinin > --->o--- > > mm, mempolicy: task->mempolicy must be NULL before dropping final reference > > KASAN allocates memory from the page allocator as part of > kmem_cache_free(), and that can reference current->mempolicy through any > number of allocation functions. It needs to be NULL'd out before the > final reference is dropped to prevent a use-after-free bug: > > BUG: KASAN: use-after-free in alloc_pages_current+0x363/0x370 at addr ffff88010b48102c > CPU: 0 PID: 15425 Comm: trinity-c2 Not tainted 4.8.0-rc2+ #140 > ... > Call Trace: > dump_stack > kasan_object_err > kasan_report_error > __asan_report_load2_noabort > alloc_pages_current <-- use after free > depot_save_stack > save_stack > kasan_slab_free > kmem_cache_free > __mpol_put <-- free > do_exit > > This patch sets current->mempolicy to NULL before dropping the final > reference. > > Reported-by: Vegard Nossum > Signed-off-by: David Rientjes > --- > include/linux/mempolicy.h | 4 ++++ > kernel/exit.c | 7 +------ > mm/mempolicy.c | 17 +++++++++++++++++ > 3 files changed, 22 insertions(+), 6 deletions(-) > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h > --- a/include/linux/mempolicy.h > +++ b/include/linux/mempolicy.h > @@ -195,6 +195,7 @@ static inline bool vma_migratable(struct vm_area_struct *vma) > } > > extern int mpol_misplaced(struct page *, struct vm_area_struct *, unsigned long); > +extern void mpol_put_task_policy(struct task_struct *); > > #else > > @@ -297,5 +298,8 @@ static inline int mpol_misplaced(struct page *page, struct vm_area_struct *vma, > return -1; /* no node preference */ > } > > +static inline void mpol_put_task_policy(struct task_struct *task) > +{ > +} > #endif /* CONFIG_NUMA */ > #endif > diff --git a/kernel/exit.c b/kernel/exit.c > --- a/kernel/exit.c > +++ b/kernel/exit.c > @@ -848,12 +848,7 @@ void do_exit(long code) > TASKS_RCU(preempt_enable()); > exit_notify(tsk, group_dead); > proc_exit_connector(tsk); > -#ifdef CONFIG_NUMA > - task_lock(tsk); > - mpol_put(tsk->mempolicy); > - tsk->mempolicy = NULL; > - task_unlock(tsk); > -#endif > + mpol_put_task_policy(tsk); > #ifdef CONFIG_FUTEX > if (unlikely(current->pi_state_cache)) > kfree(current->pi_state_cache); > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > --- a/mm/mempolicy.c > +++ b/mm/mempolicy.c > @@ -2336,6 +2336,23 @@ out: > return ret; > } > > +/* > + * Drop the (possibly final) reference to task->mempolicy. It needs to be > + * dropped after task->mempolicy is set to NULL so that any allocation done as > + * part of its kmem_cache_free(), such as by KASAN, doesn't reference a freed > + * policy. > + */ > +void mpol_put_task_policy(struct task_struct *task) > +{ > + struct mempolicy *pol; > + > + task_lock(task); > + pol = task->mempolicy; > + task->mempolicy = NULL; > + task_unlock(task); > + mpol_put(pol); > +} > + > static void sp_delete(struct shared_policy *sp, struct sp_node *n) > { > pr_debug("deleting %lx-l%lx\n", n->start, n->end); >