From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D989FC433EF for ; Wed, 6 Jul 2022 03:21:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229771AbiGFDVd (ORCPT ); Tue, 5 Jul 2022 23:21:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37240 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229535AbiGFDVb (ORCPT ); Tue, 5 Jul 2022 23:21:31 -0400 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 264901658E; Tue, 5 Jul 2022 20:21:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=U90vDWhmtLUBjb7uR4WRLKqovMSNNsXOIU8h7uSvzmI=; b=O9ay8Sm1HAiGOn+laSqNQ9UT9I qjvjJX34w8wZjox8wlNh/CeF4TXKKy7kerRsOZGMMhDbvIjl2NeMVSyXnQuOCSu9QYWEPwieQnfcY NKn7BmjFe881o29UvYRJBp4s1F2I8K6cnsvKAC8LwbmhpI7r8iL2Wr/1QkjBP9Ixer1B4QpXY8K9E u8JTeRPFLuekwEWD2lRmWVE2nTdibJQr6tO1kPMWgOtqRN1bsLYaWR0TZDiR3pv2gDOS3AIs5OFn8 cKhZ3WbKhylEqTuOWZD85CVkeXBC77TbMHkq8CiE05Ur9YQG8tx4YfF7twXLQHJI8/0ZtAEBVrlOt Yq94NsLA==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1o8vbE-0019a9-4Y; Wed, 06 Jul 2022 03:21:12 +0000 Date: Wed, 6 Jul 2022 04:21:12 +0100 From: Matthew Wilcox To: Liu Shixin Cc: Greg Kroah-Hartman , Andrew Morton , Jan Kara , William Kucharski , Christoph Hellwig , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH 5.15] mm/filemap: fix UAF in find_lock_entries Message-ID: References: <20220706032434.579610-1-liushixin2@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20220706032434.579610-1-liushixin2@huawei.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Jul 06, 2022 at 11:24:34AM +0800, Liu Shixin wrote: > Release refcount after xas_set to fix UAF which may cause panic like this: I think we can do better. How about this? diff --git a/mm/filemap.c b/mm/filemap.c index 00e391e75880..11ae38cc4fd3 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -2090,7 +2090,9 @@ unsigned find_lock_entries(struct address_space *mapping, pgoff_t start, rcu_read_lock(); while ((page = find_get_entry(&xas, end, XA_PRESENT))) { + unsigned long next_idx = xas.xa_index + 1; if (!xa_is_value(page)) { + next_idx = page->index + thp_nr_pages(page); if (page->index < start) goto put; if (page->index + thp_nr_pages(page) - 1 > end) @@ -2111,14 +2113,11 @@ unsigned find_lock_entries(struct address_space *mapping, pgoff_t start, put: put_page(page); next: - if (!xa_is_value(page) && PageTransHuge(page)) { - unsigned int nr_pages = thp_nr_pages(page); - - /* Final THP may cross MAX_LFS_FILESIZE on 32-bit */ - xas_set(&xas, page->index + nr_pages); - if (xas.xa_index < nr_pages) - break; - } + /* Final THP may cross MAX_LFS_FILESIZE on 32-bit */ + if (next_idx < xas.xa_index) + break; + if (next_idx != xas.xa_index + 1) + xas_set(&xas, next_idx); } rcu_read_unlock();