Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if
 the refcount isn't 0
To:     Filippo Sironi <sironi@amazon.de>, linux-kernel@vger.kernel.org
Cc:     dwmw@amazon.co.uk, christian.brauner@ubuntu.com,
        akpm@linux-foundation.org, ebiederm@xmission.com,
        peterz@infradead.org, keescook@chromium.org, krisman@collabora.com,
        peterx@redhat.com, surenb@google.com, shakeelb@google.com,
        guro@fb.com, elver@google.com
References: <20210310123703.27894-1-sironi@amazon.de>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <4130ef8d-7b97-f63d-00fc-0ee2b494e1d0@kernel.dk>
Date:   Wed, 10 Mar 2021 08:57:00 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20210310123703.27894-1-sironi@amazon.de>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 3/10/21 5:37 AM, Filippo Sironi wrote:
> We've seen a number of crashes with the following signature:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000000
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     ...
>     Oops: 0000 [#1] SMP PTI
>     ...
>     RIP: 0010:__rb_erase_color+0xc2/0x260
>     ...
>     Call Trace:
>      unlink_file_vma+0x36/0x50
>      free_pgtables+0x62/0x110
>      exit_mmap+0xd5/0x160
>      ? put_dec+0x3a/0x90
>      ? num_to_str+0xa8/0xc0
>      mmput+0x11/0xb0
>      do_task_stat+0x940/0xc80
>      proc_single_show+0x49/0x80
>      ? __check_object_size+0xcc/0x1a0
>      seq_read+0xd3/0x400
>      vfs_read+0x72/0xb0
>      ksys_read+0x9c/0xd0
>      do_syscall_64+0x69/0x400
>      ? schedule+0x2a/0x90
>      entry_SYSCALL_64_after_hwframe+0x44/0xa9
>     ...
> 
> This happens when a process goes through the tasks stats in procfs while
> another is exiting.  This looks like a race where the process that's
> exiting drops the last reference on the mm (with mmput) while the other
> increases it (with mmget).  By only increasing when the reference isn't
> 0 to begin with, we prevent this from happening.

From a quick look it looks reasonable, but I don't quite see how we get
in the situation of finding a valid ->mm under task_lock() and the
mm_users count being 0? I'd like to understand that, because it may just
be that your patch just narrows the gap but it's still possible to
trigger a use-after-free. Doesn't seem like that would be possible under
exit_mm().

-- 
Jens Axboe