Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH] mm: hugetlb: fix UAF in hugetlb_handle_userfault
To:     Andrew Morton <akpm@linux-foundation.org>
References: <20220921083440.1267903-1-liushixin2@huawei.com>
 <20220921120748.79f3255fa0a06b182576f497@linux-foundation.org>
CC:     Liu Zixian <liuzixian4@huawei.com>,
        Mike Kravetz <mike.kravetz@oracle.com>,
        Muchun Song <songmuchun@bytedance.com>, <linux-mm@kvack.org>,
        <linux-kernel@vger.kernel.org>,
        Kefeng Wang <wangkefeng.wang@huawei.com>
From:   Liu Shixin <liushixin2@huawei.com>
Message-ID: <ced8f78a-1f86-ee63-cc48-caed243ce197@huawei.com>
Date:   Thu, 22 Sep 2022 09:58:38 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.7.1
MIME-Version: 1.0
In-Reply-To: <20220921120748.79f3255fa0a06b182576f497@linux-foundation.org>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2022/9/22 3:07, Andrew Morton wrote:
> On Wed, 21 Sep 2022 16:34:40 +0800 Liu Shixin <liushixin2@huawei.com> wrote:
>
>> The vma_lock and hugetlb_fault_mutex are dropped before handling
>> userfault and reacquire them again after handle_userfault(), but
>> reacquire the vma_lock could lead to UAF[1] due to the following
>> race,
>>
>> hugetlb_fault
>>   hugetlb_no_page
>>     /*unlock vma_lock */
>>     hugetlb_handle_userfault
>>       handle_userfault
>>         /* unlock mm->mmap_lock*/
>>                                            vm_mmap_pgoff
>>                                              do_mmap
>>                                                mmap_region
>>                                                  munmap_vma_range
>>                                                    /* clean old vma */
>>         /* lock vma_lock again  <--- UAF */
>>     /* unlock vma_lock */
>>
>> Since the vma_lock will unlock immediately after hugetlb_handle_userfault(),
>> let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix
>> the issue.
>>
>> @@ -5508,17 +5507,12 @@ static inline vm_fault_t hugetlb_handle_userfault(struct vm_area_struct *vma,
>>  
>>  	/*
>>  	 * vma_lock and hugetlb_fault_mutex must be
>> -	 * dropped before handling userfault.  Reacquire
>> -	 * after handling fault to make calling code simpler.
>> +	 * dropped before handling userfault.
>>  	 */
>>  	hugetlb_vma_unlock_read(vma);
>>  	hash = hugetlb_fault_mutex_hash(mapping, idx);
>>  	mutex_unlock(&hugetlb_fault_mutex_table[hash]);
>> -	ret = handle_userfault(&vmf, reason);
>> -	mutex_lock(&hugetlb_fault_mutex_table[hash]);
>> -	hugetlb_vma_lock_read(vma);
>> -
>> -	return ret;
>> +	return handle_userfault(&vmf, reason);
>>  }
> Current code is rather different from this.  So if the bug still exists
> in current code, please verify this and redo the patch appropriately?
>
> And hang on to this version to help with the -stable backporting.
>
> Thanks.
> .
This patch conflicts with patch series "hugetlb: Use new vma lock for huge pmd sharing synchronization".
So I reproduce the problem on next-20220920 and this patch is based on next-20220920 instead of mainline.
This problem is existed since v4.11. I will send the stable version later.