Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <55978b11-5e7e-4b10-dff1-398275ec68b3@redhat.com>
Date:   Fri, 20 Jan 2023 17:54:28 -0500
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.6.0
Subject: Re: [RESEND PATCH v2 2/2] mm/kmemleak: Fix UAF bug in kmemleak_scan()
Content-Language: en-US
To:     Catalin Marinas <catalin.marinas@arm.com>
Cc:     Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org,
        linux-kernel@vger.kernel.org,
        Muchun Song <songmuchun@bytedance.com>
References: <20230119040111.350923-1-longman@redhat.com>
 <20230119040111.350923-3-longman@redhat.com> <Y8ro6DxR1v0XlDs3@arm.com>
From:   Waiman Long <longman@redhat.com>
In-Reply-To: <Y8ro6DxR1v0XlDs3@arm.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 1/20/23 14:18, Catalin Marinas wrote:
> Hi Waiman,
>
> Thanks for your effort on trying to fix this.
>
> On Wed, Jan 18, 2023 at 11:01:11PM -0500, Waiman Long wrote:
>> @@ -567,7 +574,9 @@ static void __remove_object(struct kmemleak_object *object)
>>   	rb_erase(&object->rb_node, object->flags & OBJECT_PHYS ?
>>   				   &object_phys_tree_root :
>>   				   &object_tree_root);
>> -	list_del_rcu(&object->object_list);
>> +	if (!(object->del_state & DELSTATE_NO_DELETE))
>> +		list_del_rcu(&object->object_list);
>> +	object->del_state |= DELSTATE_REMOVED;
>>   }
> So IIUC, this prevents the current object being scanned from being
> removed from the list during the kmemleak_cond_resched() call.

Yes, that is the point.


>
>>   /*
>> @@ -633,6 +642,7 @@ static void __create_object(unsigned long ptr, size_t size,
>>   	object->count = 0;			/* white color initially */
>>   	object->jiffies = jiffies;
>>   	object->checksum = 0;
>> +	object->del_state = 0;
>>   
>>   	/* task information */
>>   	if (in_hardirq()) {
>> @@ -1470,9 +1480,22 @@ static void kmemleak_cond_resched(struct kmemleak_object *object)
>>   	if (!get_object(object))
>>   		return;	/* Try next object */
>>   
>> +	raw_spin_lock_irq(&kmemleak_lock);
>> +	if (object->del_state & DELSTATE_REMOVED)
>> +		goto unlock_put;	/* Object removed */
>> +	object->del_state |= DELSTATE_NO_DELETE;
>> +	raw_spin_unlock_irq(&kmemleak_lock);
>> +
>>   	rcu_read_unlock();
>>   	cond_resched();
>>   	rcu_read_lock();
>> +
>> +	raw_spin_lock_irq(&kmemleak_lock);
>> +	if (object->del_state & DELSTATE_REMOVED)
>> +		list_del_rcu(&object->object_list);
>> +	object->del_state &= ~DELSTATE_NO_DELETE;
>> +unlock_put:
>> +	raw_spin_unlock_irq(&kmemleak_lock);
>>   	put_object(object);
>>   }
> I'm not sure this was the only problem. We do have the problem that the
> current object may be removed from the list, solved above, but another
> scenario I had in mind is the next object being released during this
> brief resched period. The RCU relies on object->next->next being valid
> but, with a brief rcu_read_unlock(), the object->next could be freed,
> reallocated, so object->next->next invalid.

Looking at the following scenario,

object->next => A (removed)
A->next => B (removed)

As object->next is pointing to A, A must still be allocated and not 
freed yet. Now if B is also removed, there are 2 possible case.

1) B is removed from the list after the removal of A. In that case, it 
is not possible that A is allocated, but B is freed.

2) B is removed before A. A->next can't pointed to B when it is being 
removed. Due to weak memory ordering, it is possible that another cpu 
can see A->next still pointing to B. In that case, I believe that it is 
still within the grace period where neither A or B is freed.

In fact, it is no different from a regular scanning of the object list 
without ever called cond_resched().

Cheers,
Longman