The patch titled
Subject: mm: hugetlb: fix UAF in hugetlb_handle_userfault
has been added to the -mm mm-hotfixes-unstable branch. Its filename is
mm-hugetlb-fix-uaf-in-hugetlb_handle_userfault.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche…
This patch will later appear in the mm-hotfixes-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Liu Shixin <liushixin2(a)huawei.com>
Subject: mm: hugetlb: fix UAF in hugetlb_handle_userfault
Date: Sat, 24 Sep 2022 11:49:05 +0800
The vma_lock and hugetlb_fault_mutex are dropped before handling
userfault and reacquire them again after handle_userfault(), but
reacquire the vma_lock could lead to UAF[1,2] due to the following
race,
hugetlb_fault
hugetlb_no_page
/*unlock vma_lock */
hugetlb_handle_userfault
handle_userfault
/* unlock mm->mmap_lock*/
vm_mmap_pgoff
do_mmap
mmap_region
munmap_vma_range
/* clean old vma */
/* lock vma_lock again <--- UAF */
/* unlock vma_lock */
Since the vma_lock will unlock immediately after hugetlb_handle_userfault(),
let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix
the issue.
[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/
[2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.co…
Link: https://lkml.kernel.org/r/20220924034905.2694686-1-liushixin2@huawei.com
Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook")
Signed-off-by: Liu Shixin <liushixin2(a)huawei.com>
Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com>
Reported-by: syzbot+193f9cee8638750b23cf(a)syzkaller.appspotmail.com
Reported-by: Liu Zixian <liuzixian4(a)huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz(a)oracle.com>
Cc: David Hildenbrand <david(a)redhat.com>
Cc: John Hubbard <jhubbard(a)nvidia.com>
Cc: Muchun Song <songmuchun(a)bytedance.com>
Cc: Sidhartha Kumar <sidhartha.kumar(a)oracle.com>
Cc: <stable(a)vger.kernel.org> [4.14+]
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
--- a/mm/hugetlb.c~mm-hugetlb-fix-uaf-in-hugetlb_handle_userfault
+++ a/mm/hugetlb.c
@@ -5478,7 +5478,6 @@ static inline vm_fault_t hugetlb_handle_
unsigned long addr,
unsigned long reason)
{
- vm_fault_t ret;
u32 hash;
struct vm_fault vmf = {
.vma = vma,
@@ -5496,18 +5495,14 @@ static inline vm_fault_t hugetlb_handle_
};
/*
- * hugetlb_fault_mutex and i_mmap_rwsem must be
- * dropped before handling userfault. Reacquire
- * after handling fault to make calling code simpler.
+ * vma_lock and hugetlb_fault_mutex must be dropped before handling
+ * userfault. Also mmap_lock will be dropped during handling
+ * userfault, any vma operation should be careful from here.
*/
hash = hugetlb_fault_mutex_hash(mapping, idx);
mutex_unlock(&hugetlb_fault_mutex_table[hash]);
i_mmap_unlock_read(mapping);
- ret = handle_userfault(&vmf, reason);
- i_mmap_lock_read(mapping);
- mutex_lock(&hugetlb_fault_mutex_table[hash]);
-
- return ret;
+ return handle_userfault(&vmf, reason);
}
static vm_fault_t hugetlb_no_page(struct mm_struct *mm,
@@ -5525,6 +5520,7 @@ static vm_fault_t hugetlb_no_page(struct
spinlock_t *ptl;
unsigned long haddr = address & huge_page_mask(h);
bool new_page, new_pagecache_page = false;
+ u32 hash = hugetlb_fault_mutex_hash(mapping, idx);
/*
* Currently, we are forced to kill the process in the event the
@@ -5535,7 +5531,7 @@ static vm_fault_t hugetlb_no_page(struct
if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) {
pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n",
current->pid);
- return ret;
+ goto out;
}
/*
@@ -5552,12 +5548,10 @@ retry:
page = find_lock_page(mapping, idx);
if (!page) {
/* Check for page in userfault range */
- if (userfaultfd_missing(vma)) {
- ret = hugetlb_handle_userfault(vma, mapping, idx,
+ if (userfaultfd_missing(vma))
+ return hugetlb_handle_userfault(vma, mapping, idx,
flags, haddr, address,
VM_UFFD_MISSING);
- goto out;
- }
page = alloc_huge_page(vma, haddr, 0);
if (IS_ERR(page)) {
@@ -5617,10 +5611,9 @@ retry:
if (userfaultfd_minor(vma)) {
unlock_page(page);
put_page(page);
- ret = hugetlb_handle_userfault(vma, mapping, idx,
+ return hugetlb_handle_userfault(vma, mapping, idx,
flags, haddr, address,
VM_UFFD_MINOR);
- goto out;
}
}
@@ -5678,6 +5671,8 @@ retry:
unlock_page(page);
out:
+ mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+ i_mmap_unlock_read(mapping);
return ret;
backout:
@@ -5776,11 +5771,13 @@ vm_fault_t hugetlb_fault(struct mm_struc
entry = huge_ptep_get(ptep);
/* PTE markers should be handled the same way as none pte */
- if (huge_pte_none_mostly(entry)) {
- ret = hugetlb_no_page(mm, vma, mapping, idx, address, ptep,
+ if (huge_pte_none_mostly(entry))
+ /*
+ * hugetlb_no_page will drop vma lock and hugetlb fault
+ * mutex internally, which make us return immediately.
+ */
+ return hugetlb_no_page(mm, vma, mapping, idx, address, ptep,
entry, flags);
- goto out_mutex;
- }
ret = 0;
_
Patches currently in -mm which might be from liushixin2(a)huawei.com are
mm-hugetlb-fix-uaf-in-hugetlb_handle_userfault.patch
mm-shuffle-convert-module_param_call-to-module_param_cb.patch
mm-kfence-convert-to-define_seq_attribute.patch
mm-huge_memory-prevent-thp_zero_page_alloc-increased-twice.patch
mm-memcontrol-use-kstrtobool-for-swapaccount-param-parsing.patch
This is the start of the stable review cycle for the 5.10.145 release.
There are 39 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 23 Sep 2022 15:36:33 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.145-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.10.145-rc1
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/sigmatel: Fix unused variable warning for beep power change
Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp>
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
Hyunwoo Kim <imv4bel(a)gmail.com>
video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
Youling Tang <tangyouling(a)loongson.cn>
mksysmap: Fix the mismatch of 'L0' symbols in System.map
Alexander Sverdlin <alexander.sverdlin(a)nokia.com>
MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
David Howells <dhowells(a)redhat.com>
afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
jerry.meng <jerry-meng(a)foxmail.com>
net: usb: qmi_wwan: add Quectel RM520N
Mohan Kumar <mkumard(a)nvidia.com>
ALSA: hda/tegra: Align BDL entry to 4KB boundary
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda/sigmatel: Keep power up while beep is enabled
Soenke Huster <soenke.huster(a)eknoes.de>
wifi: mac80211_hwsim: check length for virtio packets
David Howells <dhowells(a)redhat.com>
rxrpc: Fix calc of resend age
David Howells <dhowells(a)redhat.com>
rxrpc: Fix local destruction being repeated
Xiaolei Wang <xiaolei.wang(a)windriver.com>
regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
Takashi Iwai <tiwai(a)suse.de>
ASoC: nau8824: Fix semaphore unbalance at error paths
Johan Hovold <johan(a)kernel.org>
Revert "serial: 8250: Fix reporting real baudrate value in c_ospeed field"
Zheyu Ma <zheyuma97(a)gmail.com>
video: fbdev: i740fb: Error out if 'pixclock' equals zero
Ben Hutchings <benh(a)debian.org>
tools/include/uapi: Fix <asm/errno.h> for parisc and xtensa
Stefan Metzmacher <metze(a)samba.org>
cifs: don't send down the destination address to sendmsg for a SOCK_STREAM
Ronnie Sahlberg <lsahlber(a)redhat.com>
cifs: revalidate mapping when doing direct writes
Thierry Reding <treding(a)nvidia.com>
of/device: Fix up of_dma_configure_id() stub
Yipeng Zou <zouyipeng(a)huawei.com>
tracing: hold caller_addr to hardirq_{enable,disable}_ip
Yang Yingliang <yangyingliang(a)huawei.com>
parisc: ccio-dma: Add missing iounmap in error path in ccio_probe()
Stuart Menefy <stuart.menefy(a)mathembedded.com>
drm/meson: Fix OSD1 RGB to YCbCr coefficient
Stuart Menefy <stuart.menefy(a)mathembedded.com>
drm/meson: Correct OSD1 global alpha value
Pali Rohár <pali(a)kernel.org>
gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
Trond Myklebust <trond.myklebust(a)hammerspace.com>
NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0
Michael Wu <michael(a)allwinnertech.com>
pinctrl: sunxi: Fix name for A100 R_PIO
Sergey Shtylyov <s.shtylyov(a)omp.ru>
of: fdt: fix off-by-one error in unflatten_dt_nodes()
Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk>
net: dsa: mv88e6xxx: allow use of PHYs on CPU and DSA ports
Alex Hung <alex.hung(a)canonical.com>
platform/x86/intel: hid: add quirk to support Surface Go 3
Frank Li <Frank.Li(a)nxp.com>
usb: cdns3: gadget: fix new urb never complete if ep cancel previous requests
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/mobility: ignore ibm, platform-facilities updates
Nathan Lynch <nathanl(a)linux.ibm.com>
powerpc/pseries/mobility: refactor node lookup during DT update
Anatolij Gustschin <agust(a)denx.de>
dmaengine: bestcomm: fix system boot lockups
John David Anglin <dave.anglin(a)bell.net>
parisc: Flush kernel data mapping in set_pte_at() when installing pte for user page
Helge Deller <deller(a)gmx.de>
parisc: Optimize per-pagetable spinlocks
Pali Rohár <pali(a)kernel.org>
serial: 8250: Fix reporting real baudrate value in c_ospeed field
Laurent Vivier <lvivier(a)redhat.com>
KVM: PPC: Tick accounting should defer vtime accounting 'til after IRQ handling
Nicholas Piggin <npiggin(a)gmail.com>
KVM: PPC: Book3S HV: Context tracking exit guest context before enabling irqs
-------------
Diffstat:
Makefile | 4 +-
arch/mips/cavium-octeon/octeon-irq.c | 10 +++
arch/parisc/Kconfig | 10 +++
arch/parisc/include/asm/mmu_context.h | 7 ++
arch/parisc/include/asm/page.h | 2 +-
arch/parisc/include/asm/pgalloc.h | 76 ++++-------------
arch/parisc/include/asm/pgtable.h | 97 ++++++---------------
arch/parisc/kernel/asm-offsets.c | 1 -
arch/parisc/kernel/cache.c | 4 +-
arch/parisc/kernel/entry.S | 116 +++++++++++---------------
arch/parisc/mm/hugetlbpage.c | 13 ---
arch/parisc/mm/init.c | 10 +--
arch/powerpc/kvm/book3s_hv.c | 32 ++++++-
arch/powerpc/kvm/booke.c | 16 +++-
arch/powerpc/platforms/pseries/mobility.c | 77 ++++++++++-------
drivers/dma/bestcomm/ata.c | 2 +-
drivers/dma/bestcomm/bestcomm.c | 22 ++---
drivers/dma/bestcomm/fec.c | 4 +-
drivers/dma/bestcomm/gen_bd.c | 4 +-
drivers/gpio/gpio-mpc8xxx.c | 1 +
drivers/gpu/drm/meson/meson_plane.c | 2 +-
drivers/gpu/drm/meson/meson_viu.c | 2 +-
drivers/net/dsa/mv88e6xxx/chip.c | 64 +++++++-------
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/mac80211_hwsim.c | 7 +-
drivers/of/fdt.c | 2 +-
drivers/parisc/ccio-dma.c | 1 +
drivers/pinctrl/sunxi/pinctrl-sun50i-a100-r.c | 2 +-
drivers/platform/x86/intel-hid.c | 7 ++
drivers/regulator/pfuze100-regulator.c | 2 +-
drivers/usb/cdns3/gadget.c | 20 +----
drivers/video/fbdev/i740fb.c | 3 +
drivers/video/fbdev/pxa3xx-gcu.c | 2 +-
fs/afs/misc.c | 1 +
fs/cifs/file.c | 3 +
fs/cifs/transport.c | 4 +-
fs/nfs/super.c | 27 ++++--
include/linux/of_device.h | 5 +-
kernel/cgroup/cgroup-v1.c | 2 +
kernel/trace/trace_preemptirq.c | 6 +-
net/rxrpc/call_event.c | 2 +-
net/rxrpc/local_object.c | 3 +
scripts/mksysmap | 2 +-
sound/pci/hda/hda_tegra.c | 3 +-
sound/pci/hda/patch_sigmatel.c | 24 ++++++
sound/soc/codecs/nau8824.c | 17 ++--
tools/include/uapi/asm/errno.h | 4 +-
47 files changed, 378 insertions(+), 348 deletions(-)