lkml.org 
[lkml]   [2022]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v4 3/3] mm: fix use-after-free when anon vma name is used after vma is freed
    On Mon 21-02-22 21:40:25, Suren Baghdasaryan wrote:
    > When adjacent vmas are being merged it can result in the vma that was
    > originally passed to madvise_update_vma being destroyed. In the current
    > implementation, the name parameter passed to madvise_update_vma points
    > directly to vma->anon_name->name and it is used after the call to
    > vma_merge. In the cases when vma_merge merges the original vma and
    > destroys it, this will result in use-after-free bug as shown below:
    >
    > madvise_vma_behavior << passes vma->anon_name->name as name param
    > madvise_update_vma(name)
    > vma_merge
    > __vma_adjust
    > vm_area_free <-- frees the vma
    > replace_vma_anon_name(name) <-- UAF

    This seems to be stale because bare const char pointer is not passed in
    the call chain. In fact I am not even sure there is any actual UAF here
    after the rework.
    Could you be more specific in describing the scenario?

    > Fix this by raising the name refcount and stabilizing it.
    >
    > Fixes: 9a10064f5625 ("mm: add a field to store names for private anonymous memory")
    > Signed-off-by: Suren Baghdasaryan <surenb@google.com>
    > Reported-by: syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com
    > ---
    > changes in v3:
    > - Reapplied the fix after code refactoring, per Michal Hocko
    >
    > mm/madvise.c | 4 ++++
    > 1 file changed, 4 insertions(+)
    >
    > diff --git a/mm/madvise.c b/mm/madvise.c
    > index a395884aeecb..00e8105430e9 100644
    > --- a/mm/madvise.c
    > +++ b/mm/madvise.c
    > @@ -140,6 +140,8 @@ static int replace_vma_anon_name(struct vm_area_struct *vma,
    > /*
    > * Update the vm_flags on region of a vma, splitting it or merging it as
    > * necessary. Must be called with mmap_sem held for writing;
    > + * Caller should ensure anon_name stability by raising its refcount even when
    > + * anon_name belongs to a valid vma because this function might free that vma.
    > */
    > static int madvise_update_vma(struct vm_area_struct *vma,
    > struct vm_area_struct **prev, unsigned long start,
    > @@ -1021,8 +1023,10 @@ static int madvise_vma_behavior(struct vm_area_struct *vma,
    > }
    >
    > anon_name = vma_anon_name(vma);
    > + anon_vma_name_get(anon_name);
    > error = madvise_update_vma(vma, prev, start, end, new_flags,
    > anon_name);
    > + anon_vma_name_put(anon_name);
    >
    > out:
    > /*
    > --
    > 2.35.1.473.g83b2b277ed-goog

    --
    Michal Hocko
    SUSE Labs

    \
     
     \ /
      Last update: 2022-02-22 09:06    [W:5.784 / U:0.340 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site