From nobody Thu Apr 2 15:03:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F3DBC6FA86 for ; Thu, 22 Sep 2022 13:37:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231648AbiIVNhq (ORCPT ); Thu, 22 Sep 2022 09:37:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230178AbiIVNh3 (ORCPT ); Thu, 22 Sep 2022 09:37:29 -0400 Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2273C95AD5 for ; Thu, 22 Sep 2022 06:36:22 -0700 (PDT) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.57]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4MYGTY3MjDzHqKX; Thu, 22 Sep 2022 21:34:09 +0800 (CST) Received: from dggpemm100009.china.huawei.com (7.185.36.113) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 22 Sep 2022 21:36:18 +0800 Received: from huawei.com (10.175.113.32) by dggpemm100009.china.huawei.com (7.185.36.113) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Thu, 22 Sep 2022 21:36:19 +0800 From: Liu Shixin To: Liu Zixian , Mike Kravetz , Muchun Song , "Andrew Morton" , Sidhartha Kumar , John Hubbard , "David Hildenbrand" , Kefeng Wang CC: , , Liu Shixin Subject: [PATCH v2] mm: hugetlb: fix UAF in hugetlb_handle_userfault Date: Thu, 22 Sep 2022 22:10:02 +0800 Message-ID: <20220922141002.3242443-1-liushixin2@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.175.113.32] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To dggpemm100009.china.huawei.com (7.185.36.113) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.co= m/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawe= i.com/ Reported-by: syzbot+193f9cee8638750b23cf@syzkaller.appspotmail.com Reported-by: Liu Zixian Fixes: 1a1aad8a9b7b ("userfaultfd: hugetlbfs: add userfaultfd hugetlb hook") CC: stable@vger.kernel.org # 4.14+ Signed-off-by: Liu Shixin Signed-off-by: Kefeng Wang Reviewed-by: Mike Kravetz --- mm/hugetlb.c | 30 +++++++++++------------------- 1 file changed, 11 insertions(+), 19 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 9b8526d27c29..5a5d466692cf 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -5489,7 +5489,6 @@ static inline vm_fault_t hugetlb_handle_userfault(str= uct vm_area_struct *vma, unsigned long addr, unsigned long reason) { - vm_fault_t ret; u32 hash; struct vm_fault vmf =3D { .vma =3D vma, @@ -5508,17 +5507,12 @@ static inline vm_fault_t hugetlb_handle_userfault(s= truct vm_area_struct *vma, =20 /* * vma_lock and hugetlb_fault_mutex must be - * dropped before handling userfault. Reacquire - * after handling fault to make calling code simpler. + * dropped before handling userfault. */ hugetlb_vma_unlock_read(vma); hash =3D hugetlb_fault_mutex_hash(mapping, idx); mutex_unlock(&hugetlb_fault_mutex_table[hash]); - ret =3D handle_userfault(&vmf, reason); - mutex_lock(&hugetlb_fault_mutex_table[hash]); - hugetlb_vma_lock_read(vma); - - return ret; + return handle_userfault(&vmf, reason); } =20 static vm_fault_t hugetlb_no_page(struct mm_struct *mm, @@ -5537,6 +5531,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *m= m, unsigned long haddr =3D address & huge_page_mask(h); bool new_page, new_pagecache_page =3D false; bool reserve_alloc =3D false; + u32 hash =3D hugetlb_fault_mutex_hash(mapping, idx); =20 /* * Currently, we are forced to kill the process in the event the @@ -5547,7 +5542,7 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *m= m, if (is_vma_resv_set(vma, HPAGE_RESV_UNMAPPED)) { pr_warn_ratelimited("PID %d killed due to inadequate hugepage pool\n", current->pid); - return ret; + goto out; } =20 /* @@ -5561,12 +5556,10 @@ static vm_fault_t hugetlb_no_page(struct mm_struct = *mm, if (idx >=3D size) goto out; /* Check for page in userfault range */ - if (userfaultfd_missing(vma)) { - ret =3D hugetlb_handle_userfault(vma, mapping, idx, + if (userfaultfd_missing(vma)) + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MISSING); - goto out; - } =20 page =3D alloc_huge_page(vma, haddr, 0); if (IS_ERR(page)) { @@ -5634,10 +5627,9 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *= mm, if (userfaultfd_minor(vma)) { unlock_page(page); put_page(page); - ret =3D hugetlb_handle_userfault(vma, mapping, idx, + return hugetlb_handle_userfault(vma, mapping, idx, flags, haddr, address, VM_UFFD_MINOR); - goto out; } } =20 @@ -5695,6 +5687,8 @@ static vm_fault_t hugetlb_no_page(struct mm_struct *m= m, =20 unlock_page(page); out: + hugetlb_vma_unlock_read(vma); + mutex_unlock(&hugetlb_fault_mutex_table[hash]); return ret; =20 backout: @@ -5792,11 +5786,9 @@ vm_fault_t hugetlb_fault(struct mm_struct *mm, struc= t vm_area_struct *vma, =20 entry =3D huge_ptep_get(ptep); /* PTE markers should be handled the same way as none pte */ - if (huge_pte_none_mostly(entry)) { - ret =3D hugetlb_no_page(mm, vma, mapping, idx, address, ptep, + if (huge_pte_none_mostly(entry)) + return hugetlb_no_page(mm, vma, mapping, idx, address, ptep, entry, flags); - goto out_mutex; - } =20 ret =3D 0; =20 --=20 2.25.1