Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Liam Howlett <liam.howlett@oracle.com>
To:     Jann Horn <jannh@google.com>
CC:     Linux-MM <linux-mm@kvack.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        kernel list <linux-kernel@vger.kernel.org>,
        Jason Donenfeld <Jason@zx2c4.com>, Yu Zhao <yuzhao@google.com>,
        "Matthew Wilcox (Oracle)" <willy@infradead.org>,
        SeongJae Park <sj@kernel.org>, Vlastimil Babka <vbabka@suse.cz>
Subject: Re: brk() in v6.1-rc1 can expand file mappings, seemingly without
 taking file locks
Thread-Topic: brk() in v6.1-rc1 can expand file mappings, seemingly without
 taking file locks
Thread-Index: AQHZBn9x0KFZBKEIUUmTP5jKLrp83a5fZLqA
Date:   Mon, 5 Dec 2022 14:50:12 +0000
Message-ID: <20221205145005.ku75npr3dsz3fqgo@revolver>
References: <CAG48ez1tJZTOjS_FjRZhvtDA-STFmdw8PEizPDwMGFd_ui0Nrw@mail.gmail.com>
In-Reply-To: <CAG48ez1tJZTOjS_FjRZhvtDA-STFmdw8PEizPDwMGFd_ui0Nrw@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?6WRZGpqd5JjDsQ131dGy/4d200bJ0TPIEi9FY7H9vq9LBN9WZ6vgYPLCzkQu?=
 =?us-ascii?Q?mAziBS0K4E7xovZHyPh2aSLpeMFzthW/M9l9ltqnnSZaw8VYUiC5WTfN6JZB?=
 =?us-ascii?Q?N/QiE5KHFuN5NNrG20WYlt4yFO9b5ZvPtVsjlH+le8NToGtiHX/TpnagCeE+?=
 =?us-ascii?Q?F7noRBLgOSsRErTb2zAf+XbgytbMv5s5LOEizPtiJYfhYIwkwERq/gAIGQ7L?=
 =?us-ascii?Q?pkIYm7yqQXMsEUqdRH9BbjX3df7Pew5A/KZMW9hqj0g6igdQ0EBn7wPzGUIO?=
 =?us-ascii?Q?1xZRJUv40s/UeTpjmn0wqO5QqsTmNlwPuaHpDjVEbySz5u8mZbos4UPq/LEd?=
 =?us-ascii?Q?V9xBrDn48Ocp5ZEuMxA9G+W4Jo0Kt7qA1QVW6JqVi0DwdJR+cSjwHp/CFGsN?=
 =?us-ascii?Q?WsedYXmr+ZkUiwohU6Wk1m2eobUU1oju9yfQKvFmmeJaZsy5xYGwtHEc4tHQ?=
 =?us-ascii?Q?s+6wkvandss/dgergYW7ZIsAyGTFwMlVti+Sr5Bla9eznCH+BcfXxGEpjLhO?=
 =?us-ascii?Q?cjDwUJHL4PO2qM3f9e4P5JVd2btECH+rFqPU+4cW+ESu+MDYCzFMfr6z/Ml+?=
 =?us-ascii?Q?Kqsqh1lceSF9ID2XmFYMoJhDVaEZ6qGTDcfDGaxH83IdZqZ49T0wNQh3r8Te?=
 =?us-ascii?Q?vKBanPTpsCAwm8Fj4ant6U7LHq6QgE3JIHeViupGuz4fny7cWdmkwlVpxKGb?=
 =?us-ascii?Q?+U1fQYUDfgajnOz6rWqo+TahtqBb7utHZwefye8mrUk7yS87Y5wtF1z0rhNN?=
 =?us-ascii?Q?b4zm1Is2D2HLM33ue2nKSH8UTUeld8Njx0Bf2YxT0sNn7z50lwGc+8S81wFt?=
 =?us-ascii?Q?7TAIgKA7zuqcqnlBa9XjYtm8ktrL5AEdj5iEq3AKw3sQQmWUXV9e0uNuztLR?=
 =?us-ascii?Q?3NKpqW6TjwkJM/Jg61AbDvKeV++BWwnCJwcTThHXJ6AMP+3lWBUDuv9HtnVc?=
 =?us-ascii?Q?2WPDnKb5dUTui17VLH7PW0KDGqkVx1ftUX5UZy71jWFhF6mrAV2Q0g2zi3r+?=
 =?us-ascii?Q?BdLP5gbyFrbQF52wpFqt8RG2963fWYAoGAyvSewtkYRbbiHAf8I2aZuL+F3Z?=
 =?us-ascii?Q?RbEyaw+hMID9NXYpxgC2V64bIUw/Oge01H2nlMIwQdsGWbQGY6OVW1WrBPfJ?=
 =?us-ascii?Q?+dY8oCd3gbPJHLnffPCzUC8Hj52RP6tC5ypZohv9SavsK1QOfIcBvJqYRE8g?=
 =?us-ascii?Q?CsxpaWr3w3GZpoVZauR9j1T5KNy0OFG6J7P/dPY6PpyMt2F121pJCuEj8IJE?=
 =?us-ascii?Q?0Shoj8SUjPvrSM3IFt6rs6d+HyievWxkCvzNYBmtzQw6Z4HUJahnvacVbX8f?=
 =?us-ascii?Q?bP9yQkdtx7nAPH+elEQhzzjp+zu60GU4pA8UGnaK00l2LErT8FCzky2ybBbl?=
 =?us-ascii?Q?goxrIfGBHqx+yrn70k26UC8zIumBme9wlt+oNBsCBUT4wDGKsP3udmOwBzSs?=
 =?us-ascii?Q?PSY1BJ33OcYStKhi8T3jSi1KpS1qIu70Y21+AhwxktFGhZaxKrKRCVloornU?=
 =?us-ascii?Q?VdXrqdhBwavvvFn8CK8cZxjS/gN9G1gL+dowgaGgEEQwvSbwwvtm4h9CMlgB?=
 =?us-ascii?Q?AYkQVdtzdPADkVWiykFB+82yIIDi0EvhN74R+cQAtTvYDZtnfB34073pGATI?=
 =?us-ascii?Q?vA=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <0E89E81611233F44922C56FCF93F265A@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: =?us-ascii?Q?NO45M1X5yndr1wGXiJkg3rDC3xCh0tzMfEFPz+uOn26m7WHB1HLSW+rxBil/?=
 =?us-ascii?Q?wNcTH3KreFXv50Mp/YcOmtxjNQjtgW2/yhuQCX+klPE+iWHmaYRDcS1pm+Gn?=
 =?us-ascii?Q?bMquYUgVSgSTR80iOnjJPU6C7fkv6j9wFn9L5g2Mk7vXKk24G6ibpewjyDkV?=
 =?us-ascii?Q?QrDWzFDw8gX9Wm91VMVtaFzQ7ZZCbM4dkQuhqd40lTpH67lqRGFkuZ5zZO9p?=
 =?us-ascii?Q?+MFBBdum3GcItjNaEMET+kskwstOoqhuSdJ//QXSp++QVaB0RdcMXkD7+uHj?=
 =?us-ascii?Q?h0khjnQwyR5fLk3ytxSZyPKtFI9GmBRw3m4xhnhh0C/faPGTYNvSfD+L7LYF?=
 =?us-ascii?Q?ghGr8RX+VbIRmmCPGSecRHQJWVbqIMg9LbqpSM7PFI24OORj05ncSZlKI77k?=
 =?us-ascii?Q?S4wk8uA4dzzZvVmnoPQMjEP0EhcOajeP6livHvpapvHiBpll/GPgRqHpLKO8?=
 =?us-ascii?Q?YlrqJQEWKkB1LpsXvn9a2UWPjX5MEiEDjm6IabNnXfSFnpqj0aEJENKIT+ae?=
 =?us-ascii?Q?7I82uOmVJO+pgHcsZHjse2jHQ8XAAPE+oXAOCuzGvXAVtf02kV13WMJ9JjbE?=
 =?us-ascii?Q?huFk1pHjAuN+DgdrOVP2vgtutImiIOkNE5D2qKeVnI71Q5MOyzGUtlypw7vE?=
 =?us-ascii?Q?sUuw1XV3n4WXhlHMx/zkQnv83XIiokcPfizE6+uccAYDY7Un74MKUNySJe3U?=
 =?us-ascii?Q?UHGOx3rrOTXVeJAyGl7t9JB7n8/rRsCv7SzQY62MDW4sR9g38RBERo4l+wYj?=
 =?us-ascii?Q?kxxf5VEaZw3Tez3NeCFPAQ0SN+BSum54THZTnJXIgH+6F1V0MK7w9N+ZHZc+?=
 =?us-ascii?Q?LNH4tElBKQjAbDAo+wRDsRXeZ38XVceeoUHFTJKtmpdSd6ALYU6LgfBYkJvw?=
 =?us-ascii?Q?4MwMdvtjyF/XXl2CMCFb5jIAwWOXsP1pTp/NPRjUi3mITdl/JePFfdjdB6+5?=
 =?us-ascii?Q?eL/CWVRN8Dvlay3ZD3iUBHV0crLr1oxzbgU00Ew32Xocpu3EjQbS6EXb9QHR?=
 =?us-ascii?Q?Snrx3W4/jPqlu+9xXxV0y5Z/UA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SN6PR10MB3022.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d4e06efc-8944-4cc4-fa4c-08dad6d003a9
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Dec 2022 14:50:12.9359
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: QVbi4+fEmnSLI03E+jOHQeJOTsJyGuD4dn6m7hK1seT4TgkGi7bO3+gQhg2rxUAXgBl9fHGcYyL1rcmk286W+Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR10MB6811
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.923,Hydra:6.0.545,FMLib:17.11.122.1
 definitions=2022-12-05_01,2022-12-05_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 mlxlogscore=442 mlxscore=0
 adultscore=0 phishscore=0 suspectscore=0 malwarescore=0 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2210170000
 definitions=main-2212050122
X-Proofpoint-ORIG-GUID: mpzoJl5r2KWjMAjpAB0jF_wc_Vx-eBBc
X-Proofpoint-GUID: mpzoJl5r2KWjMAjpAB0jF_wc_Vx-eBBc
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* Jann Horn <jannh@google.com> [221202 13:54]:
> As of commit ca57f02295f, brk() can expand ordinary file mappings (but
> not file mappings with weird flags), and I think it does it with
> insufficient locks. I think brk() probably needs some extra checks to
> make sure it's operating on a brk-like VMA (which means it should at
> least be anonymous, and perhaps pass the full can_vma_merge_after()
> check so that we're not creating unnecessary special cases?).


Thanks.  This is probably caused by commit 2e7ce7d354f2: "mm/mmap:
change do_brk_flags() to expand existing VMA and add do_brk_munmap()"

Specifically the checks around expanding the VMA.=20

> user@vm:~/brk_stretch$ cat brk_file.c

Thanks for the testcase.  I have a fix that I'm testing, but it's worth
noting that the brk call will succeed - except a new VMA will be
created.  Is this what you expect?

...
>=20
> The codepaths that are intended to expand file VMAs do stuff like
> i_mmap_lock_write() and vma_interval_tree_remove(), which
> do_brk_flags() doesn't seem to do (because it was never intended to
> operate on file VMAs?).

I don't think the locks were there before and I think you are correct
that it wasn't intended to operate on file VMAs.  I made sure all the
ltp tests around brk pass with my changes but this seems insufficient.