Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 20 Jan 2023 19:18:00 +0000
From:   Catalin Marinas <catalin.marinas@arm.com>
To:     Waiman Long <longman@redhat.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org,
        Muchun Song <songmuchun@bytedance.com>
Subject: Re: [RESEND PATCH v2 2/2] mm/kmemleak: Fix UAF bug in kmemleak_scan()
Message-ID: <Y8ro6DxR1v0XlDs3@arm.com>
References: <20230119040111.350923-1-longman@redhat.com>
 <20230119040111.350923-3-longman@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230119040111.350923-3-longman@redhat.com>
Precedence: bulk

Hi Waiman,

Thanks for your effort on trying to fix this.

On Wed, Jan 18, 2023 at 11:01:11PM -0500, Waiman Long wrote:
> @@ -567,7 +574,9 @@ static void __remove_object(struct kmemleak_object *object)
>  	rb_erase(&object->rb_node, object->flags & OBJECT_PHYS ?
>  				   &object_phys_tree_root :
>  				   &object_tree_root);
> -	list_del_rcu(&object->object_list);
> +	if (!(object->del_state & DELSTATE_NO_DELETE))
> +		list_del_rcu(&object->object_list);
> +	object->del_state |= DELSTATE_REMOVED;
>  }

So IIUC, this prevents the current object being scanned from being
removed from the list during the kmemleak_cond_resched() call.

>  /*
> @@ -633,6 +642,7 @@ static void __create_object(unsigned long ptr, size_t size,
>  	object->count = 0;			/* white color initially */
>  	object->jiffies = jiffies;
>  	object->checksum = 0;
> +	object->del_state = 0;
>  
>  	/* task information */
>  	if (in_hardirq()) {
> @@ -1470,9 +1480,22 @@ static void kmemleak_cond_resched(struct kmemleak_object *object)
>  	if (!get_object(object))
>  		return;	/* Try next object */
>  
> +	raw_spin_lock_irq(&kmemleak_lock);
> +	if (object->del_state & DELSTATE_REMOVED)
> +		goto unlock_put;	/* Object removed */
> +	object->del_state |= DELSTATE_NO_DELETE;
> +	raw_spin_unlock_irq(&kmemleak_lock);
> +
>  	rcu_read_unlock();
>  	cond_resched();
>  	rcu_read_lock();
> +
> +	raw_spin_lock_irq(&kmemleak_lock);
> +	if (object->del_state & DELSTATE_REMOVED)
> +		list_del_rcu(&object->object_list);
> +	object->del_state &= ~DELSTATE_NO_DELETE;
> +unlock_put:
> +	raw_spin_unlock_irq(&kmemleak_lock);
>  	put_object(object);
>  }

I'm not sure this was the only problem. We do have the problem that the
current object may be removed from the list, solved above, but another
scenario I had in mind is the next object being released during this
brief resched period. The RCU relies on object->next->next being valid
but, with a brief rcu_read_unlock(), the object->next could be freed,
reallocated, so object->next->next invalid.

-- 
Catalin