moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
90af5dfd5050e2b00ffe6d7f2ed96ffa79b2482c
kernel_arpi/mm
History
Suren Baghdasaryan 9b71fb2a76 UPSTREAM: mm: fix use-after-free bug when mm->mmap is reused after being freed 
65;7000;1coom reaping (__oom_reap_task_mm) relies on a 2 way synchronization with
exit_mmap.  First it relies on the mmap_lock to exclude from unlock
path[1], page tables tear down (free_pgtables) and vma destruction.
This alone is not sufficient because mm->mmap is never reset.

For historical reasons[2] the lock is taken there is also MMF_OOM_SKIP
set for oom victims before.

The oom reaper only ever looks at oom victims so the whole scheme works
properly but process_mrelease can opearate on any task (with fatal
signals pending) which doesn't really imply oom victims.  That means
that the MMF_OOM_SKIP part of the synchronization doesn't work and it
can see a task after the whole address space has been demolished and
traverse an already released mm->mmap list.  This leads to use after
free as properly caught up by KASAN report.

Fix the issue by reseting mm->mmap so that MMF_OOM_SKIP synchronization
is not needed anymore.  The MMF_OOM_SKIP is not removed from exit_mmap
yet but it acts mostly as an optimization now.

[1] 27ae357fa8 ("mm, oom: fix concurrent munlock and oom reaper unmap, v3")
[2] 2129258024 ("mm: oom: let oom_reap_task and exit_mmap run concurrently")

[mhocko@suse.com: changelog rewrite]

Bug: 254441685
Link: https://lore.kernel.org/all/00000000000072ef2c05d7f81950@google.com/
Link: https://lkml.kernel.org/r/20220215201922.1908156-1-surenb@google.com
Fixes: 64591e8605d6 ("mm: protect free_pgtables with mmap_lock write lock in exit_mmap")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Reported-by: syzbot+2ccf63a4bd07cf39cab0@syzkaller.appspotmail.com
Suggested-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Rik van Riel <riel@surriel.com>
Reviewed-by: Yang Shi <shy828301@gmail.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Rik van Riel <riel@surriel.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Kirill A. Shutemov <kirill@shutemov.name>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Jan Engelhardt <jengelh@inai.de>
Cc: Tim Murray <timmurray@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit f798a1d4f94de9510e060d37b9b47721065a957c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I84fdfe87bab3df5e0ee6f1444e606b353f2e4662
2022-12-19 16:30:28 +00:00
..
damon
Merge 5.15.79 into android14-5.15
2022-11-16 10:04:35 +00:00
kasan
Merge 5.15.38 into android14-5.15
2022-06-09 10:28:01 +02:00
kfence
mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool
2022-05-25 09:57:23 +02:00
backing-dev.c
writeback: avoid use-after-free after removing device
2022-08-31 17:16:47 +02:00
balloon_compaction.c
…
bootmem_info.c
bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem
2022-08-31 17:16:48 +02:00
cleancache.c
…
cma_debug.c
…
cma_sysfs.c
…
cma.c
Merge 5.15.46 into android14-5.15
2022-07-13 11:40:42 +02:00
cma.h
…
compaction.c
Merge 5.15.82 into android14-5.15
2022-12-08 16:43:35 +00:00
debug_page_ref.c
…
debug_vm_pgtable.c
mm/debug_vm_pgtable: remove pte entry from the page table
2022-02-08 18:34:05 +01:00
debug.c
FROMLIST: mm: export dump_mm
2022-03-23 11:32:12 -07:00
dmapool.c
…
early_ioremap.c
mm/early_ioremap.c: remove redundant early_ioremap_shutdown()
2021-09-08 11:50:24 -07:00
fadvise.c
…
failslab.c
…
filemap.c
Merge 5.15.80 into android14-5.15
2022-11-28 16:08:50 +00:00
frontswap.c
…
gup_test.c
…
gup_test.h
…
gup.c
mm/gup: fix gup_pud_range() for dax
2022-12-14 11:37:20 +01:00
highmem.c
highmem: fix checks in __kmap_local_sched_{in,out}
2022-04-13 20:59:21 +02:00
hmm.c
mm/hmm: fault non-owner device private entries
2022-08-03 12:03:54 +02:00
huge_memory.c
BACKPORT: mm: multi-gen LRU: groundwork
2022-11-30 00:28:11 +00:00
hugetlb_cgroup.c
…
hugetlb_vmemmap.c
mm: hugetlb: introduce CONFIG_HUGETLB_PAGE_FREE_VMEMMAP_DEFAULT_ON
2021-06-30 20:47:26 -07:00
hugetlb_vmemmap.h
mm: hugetlb: introduce nr_free_vmemmap_pages in the struct hstate
2021-06-30 20:47:25 -07:00
hugetlb.c
hugetlbfs: don't delete error page from pagecache
2022-11-26 09:24:33 +01:00
hwpoison-inject.c
mm/hwpoison: avoid the impact of hwpoison_filter() return value on mce handler
2022-07-12 16:35:05 +02:00
init-mm.c
mm: add setup_initial_init_mm() helper
2021-07-08 11:48:21 -07:00
internal.h
BACKPORT: mm: multi-gen LRU: exploit locality in rmap
2022-11-30 00:28:11 +00:00
interval_tree.c
…
io-mapping.c
…
ioremap.c
mm: move ioremap_page_range to vmalloc.c
2021-09-08 11:50:24 -07:00
Kconfig
ANDROID: GKI: MGLRU: Ensure spare page flags bits
2022-11-30 00:28:11 +00:00
Kconfig.debug
FROMLIST: mm: anon spf statistics
2022-03-23 11:32:17 -07:00
khugepaged.c
Merge 5.15.83 into android14-5.15
2022-12-14 13:04:18 +01:00
kmemleak.c
Merge 5.15.68 into android14-5.15
2022-09-24 14:12:45 +02:00
ksm.c
mm/ksm: remove old GCC 4.9+ check
2021-09-13 10:18:28 -07:00
list_lru.c
…
maccess.c
maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault()
2022-11-26 09:24:47 +01:00
madvise.c
Merge 5.15.72 into android14-5.15
2022-10-05 11:59:55 +02:00
Makefile
mm: introduce Data Access MONitor (DAMON)
2021-09-08 11:50:24 -07:00
mapping_dirty_helpers.c
mm/mapping_dirty_helpers: remove double Note in kerneldoc
2021-07-01 11:06:02 -07:00
memblock.c
Merge 5.15.26 into android13-5.15
2022-03-16 12:53:52 +01:00
memcontrol.c
Merge 5.15.83 into android14-5.15
2022-12-14 13:04:18 +01:00
memfd.c
memfd: fix F_SEAL_WRITE after shmem huge page allocated
2022-03-08 19:12:48 +01:00
memory_hotplug.c
ANDROID: mm/memory_hotplug: Don't special case memory_block_size_bytes
2022-07-19 03:52:50 +00:00
memory-failure.c
hugetlbfs: don't delete error page from pagecache
2022-11-26 09:24:33 +01:00
memory.c
BACKPORT: mm: multi-gen LRU: groundwork
2022-11-30 00:28:11 +00:00
mempolicy.c
Merge 5.15.61 into android14-5.15
2022-09-21 17:30:12 +02:00
mempool.c
…
memremap.c
mm/memremap.c: map FS_DAX device memory as decrypted
2022-11-16 09:58:27 +01:00
memtest.c
…
migrate.c
Merge 5.15.72 into android14-5.15
2022-10-05 11:59:55 +02:00
mincore.c
…
mlock.c
Merge 5.15.40 into android-5.15
2022-06-09 15:39:10 +02:00
mm_init.c
BACKPORT: mm: multi-gen LRU: groundwork
2022-11-30 00:28:11 +00:00
mmap_lock.c
mm: mmap_lock: fix disabling preemption directly
2021-07-23 17:43:28 -07:00
mmap.c
UPSTREAM: mm: fix use-after-free bug when mm->mmap is reused after being freed
2022-12-19 16:30:28 +00:00
mmu_gather.c
mm/khugepaged: fix GUP-fast interaction by sending IPI
2022-12-14 11:37:17 +01:00
mmu_notifier.c
mm/mmu_notifier.c: fix race in mmu_interval_notifier_remove()
2022-04-27 14:38:58 +02:00
mmzone.c
BACKPORT: mm: multi-gen LRU: groundwork
2022-11-30 00:28:11 +00:00
mprotect.c
UPSTREAM: mm: refactor vm_area_struct::anon_vma_name usage code
2022-03-24 18:44:39 -07:00
mremap.c
ANDROID: mm: preserve vma->anon_vma after MREMAP_DONTUNMAP for SPF
2022-11-23 10:27:02 -08:00
msync.c
…
nommu.c
ANDROID: mm: avoid using vmacache in lockless vma search
2022-11-23 10:25:27 -08:00
oom_kill.c
Merge 5.15.36 into android14-5.15
2022-06-06 11:12:02 +02:00
OWNERS
…
page_alloc.c
BACKPORT: mm: add NR_SECONDARY_PAGETABLE to count secondary page table uses.
2022-11-23 17:11:25 +00:00
page_counter.c
ANDROID: Add vendor hook for MemcgV2 optimization
2022-07-19 12:47:28 +00:00
page_ext.c
ANDROID: mm: Export lookup_page_ext
2021-11-23 11:59:24 +05:30
page_idle.c
mm/idle_page_tracking: make PG_idle reusable
2021-09-08 11:50:24 -07:00
page_io.c
mm: fix unexpected zeroed page mapping with zram swap
2022-04-20 09:34:18 +02:00
page_isolation.c
Merge branch 'akpm' (patches from Andrew)
2021-09-08 12:55:35 -07:00
page_owner.c
ANDROID: mm: add get_page_owner_handle function
2021-11-23 09:30:23 +00:00
page_poison.c
…
page_reporting.c
ANDROID: KVM: arm64: balloon: Notify hyp before reporting free pages to host
2022-11-11 16:07:56 +00:00
page_reporting.h
…
page_vma_mapped.c
mm: device exclusive memory access
2021-07-01 11:06:03 -07:00
page-writeback.c
writeback: avoid use-after-free after removing device
2022-08-31 17:16:47 +02:00
pagewalk.c
mm: pagewalk: Fix race between unmap and page walker
2022-09-08 12:28:05 +02:00
percpu-internal.h
Merge branch 'for-5.14' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu
2021-07-01 17:17:24 -07:00
percpu-km.c
percpu: flush tlb in pcpu_reclaim_populated()
2021-07-04 18:30:17 +00:00
percpu-stats.c
…
percpu-vm.c
percpu: flush tlb in pcpu_reclaim_populated()
2021-07-04 18:30:17 +00:00
percpu.c
ANDROID: mm: Export pcpu_nr_pages
2022-04-27 16:02:52 +00:00
pgalloc-track.h
…
pgtable-generic.c
…
process_vm_access.c
…
ptdump.c
mm: pagewalk: Fix race between unmap and page walker
2022-09-08 12:28:05 +02:00
readahead.c
Merge 4520dcbe0d ("Merge tag 'for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply") into android-mainline
2021-09-02 09:42:36 +02:00
rmap.c
BACKPORT: mm: multi-gen LRU: exploit locality in rmap
2022-11-30 00:28:11 +00:00
rodata_test.c
…
secretmem.c
mm: fix dereferencing possible ERR_PTR
2022-10-05 10:39:39 +02:00
shmem.c
Merge 5.15.80 into android14-5.15
2022-11-28 16:08:50 +00:00
shuffle.c
…
shuffle.h
…
slab_common.c
ANDROID: vendor_hooks: Add hooks for memory when debug
2022-07-19 03:52:51 +00:00
slab.c
Merge 5.15.36 into android14-5.15
2022-06-06 11:12:02 +02:00
slab.h
Merge 5.15.36 into android14-5.15
2022-06-06 11:12:02 +02:00
slob.c
mm, kfence: support kmem_dump_obj() for KFENCE objects
2022-04-27 14:38:51 +02:00
slub.c
Merge 5.15.71 into android14-5.15
2022-09-28 13:32:32 +02:00
sparse-vmemmap.c
mm: sparsemem: split the huge PMD mapping of vmemmap pages
2021-06-30 20:47:26 -07:00
sparse.c
mm: introduce memmap_alloc() to unify memory map allocation
2021-09-03 09:58:15 -07:00
swap_cgroup.c
…
swap_slots.c
mm: Replace deprecated CPU-hotplug functions.
2021-08-28 01:46:17 +02:00
swap_state.c
mm: swap: get rid of livelock in swapin readahead
2022-03-23 09:16:41 +01:00
swap.c
BACKPORT: mm: multi-gen LRU: exploit locality in rmap
2022-11-30 00:28:11 +00:00
swapfile.c
ANDROID: mm: Export si_swapinfo
2021-11-23 11:59:24 +05:30
truncate.c
Merge branch 'akpm' (patches from Andrew)
2021-09-03 10:08:28 -07:00
usercopy.c
mm/usercopy: return 1 from hardened_usercopy __setup() handler
2022-04-08 14:24:14 +02:00
userfaultfd.c
mm: shmem: don't truncate page if memory failure happens
2022-11-26 09:24:28 +01:00
util.c
Merge 5.15.54 into android14-5.15
2022-07-13 19:41:43 +02:00
vmacache.c
…
vmalloc.c
ANDROID: mm/vmalloc: Add arch-specific callbacks to track io{remap,unmap} physical pages
2022-08-04 13:03:53 +00:00
vmpressure.c
mm/vmpressure: replace vmpressure_to_css() with vmpressure_to_memcg()
2021-09-03 09:58:17 -07:00
vmscan.c
Merge 5.15.82 into android14-5.15
2022-12-08 16:43:35 +00:00
vmstat.c
BACKPORT: mm: add NR_SECONDARY_PAGETABLE to count secondary page table uses.
2022-11-23 17:11:25 +00:00
workingset.c
BACKPORT: mm: multi-gen LRU: minimal implementation
2022-11-30 00:28:11 +00:00
z3fold.c
mm/z3fold: add kerneldoc fields for z3fold_pool
2021-07-01 11:06:03 -07:00
zbud.c
mm/zbud: add kerneldoc fields for zbud_pool
2021-07-01 11:06:03 -07:00
zpool.c
…
zsmalloc.c
Merge 5.15.45 into android14-5.15
2022-07-09 11:22:04 +02:00
zswap.c
mm/zswap.c: fix two bugs in zswap_writeback_entry()
2021-06-30 20:47:31 -07:00