Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Sender: vjitta=codeaurora.org@mg.codeaurora.org
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 4DE6EC433CA
Subject: Re: [PATCH] mm: vmalloc: Prevent use after free in _vm_unmap_aliases
To:     Uladzislau Rezki <urezki@gmail.com>
Cc:     akpm@linux-foundation.org, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org, vinmenon@codeaurora.org
References: <1616062105-23263-1-git-send-email-vjitta@codeaurora.org>
 <20210318165907.GA10448@pc638.lan>
From:   Vijayanand Jitta <vjitta@codeaurora.org>
Message-ID: <803dc8ec-d1a2-ed26-ddab-a5258e60d318@codeaurora.org>
Date:   Wed, 24 Mar 2021 08:59:37 +0530
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <20210318165907.GA10448@pc638.lan>
Content-Type: text/plain; charset=utf-8
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 3/18/2021 10:29 PM, Uladzislau Rezki wrote:
> On Thu, Mar 18, 2021 at 03:38:25PM +0530, vjitta@codeaurora.org wrote:
>> From: Vijayanand Jitta <vjitta@codeaurora.org>
>>
>> A potential use after free can occur in _vm_unmap_aliases
>> where an already freed vmap_area could be accessed, Consider
>> the following scenario:
>>
>> Process 1						Process 2
>>
>> __vm_unmap_aliases					__vm_unmap_aliases
>> 	purge_fragmented_blocks_allcpus				rcu_read_lock()
>> 		rcu_read_lock()
>> 			list_del_rcu(&vb->free_list)
>> 									list_for_each_entry_rcu(vb .. )
>> 	__purge_vmap_area_lazy
>> 		kmem_cache_free(va)
>> 										va_start = vb->va->va_start
> Or maybe we should switch to kfree_rcu() instead of kmem_cache_free()?
> 
> --
> Vlad Rezki
> 

Thanks for suggestion.

I see free_vmap_area_lock (spinlock) is taken in __purge_vmap_area_lazy
while it loops through list and calls kmem_cache_free on va's. So, looks
like we can't replace it with kfree_rcu as it might cause scheduling
within atomic context.

Thanks,
Vijay
-- 
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of Code Aurora Forum, hosted by The Linux Foundation