Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 384632e6 authored by Andrea Arcangeli's avatar Andrea Arcangeli Committed by Linus Torvalds
Browse files

userfaultfd: non-cooperative: fix fork use after free 

When reading the event from the uffd, we put it on a temporary
fork_event list to detect if we can still access it after releasing and
retaking the event_wqh.lock.

If fork aborts and removes the event from the fork_event all is fine as
long as we're still in the userfault read context and fork_event head is
still alive.

We've to put the event allocated in the fork kernel stack, back from
fork_event list-head to the event_wqh head, before returning from
userfaultfd_ctx_read, because the fork_event head lifetime is limited to
the userfaultfd_ctx_read stack lifetime.

Forgetting to move the event back to its event_wqh place then results in
__remove_wait_queue(&ctx->event_wqh, &ewq->wq); in
userfaultfd_event_wait_completion to remove it from a head that has been
already freed from the reader stack.

This could only happen if resolve_userfault_fork failed (for example if
there are no file descriptors available to allocate the fork uffd).  If
it succeeded it was put back correctly.

Furthermore, after find_userfault_evt receives a fork event, the forked
userfault context in fork_nctx and uwq->msg.arg.reserved.reserved1 can
be released by the fork thread as soon as the event_wqh.lock is
released.  Taking a reference on the fork_nctx before dropping the lock
prevents an use after free in resolve_userfault_fork().

If the fork side aborted and it already released everything, we still
try to succeed resolve_userfault_fork(), if possible.

Fixes: 893e26e6 ("userfaultfd: non-cooperative: Add fork() event")
Link: http://lkml.kernel.org/r/20170920180413.26713-1-aarcange@redhat.com


Signed-off-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
Tested-by: default avatarMark Rutland <mark.rutland@arm.com>
Cc: Pavel Emelyanov <xemul@virtuozzo.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7d790d2d

fs/userfaultfd.c

+56 −10
Original line number Original line Diff line number Diff line
@@ -588,6 +588,12 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, 
			break;

			break;

		if (ACCESS_ONCE(ctx->released) ||

		if (ACCESS_ONCE(ctx->released) ||

		    fatal_signal_pending(current)) {

		    fatal_signal_pending(current)) {

			/*

			 * &ewq->wq may be queued in fork_event, but

			 * __remove_wait_queue ignores the head

			 * parameter. It would be a problem if it

			 * didn't.

			 */

			__remove_wait_queue(&ctx->event_wqh, &ewq->wq);

			__remove_wait_queue(&ctx->event_wqh, &ewq->wq);

			if (ewq->msg.event == UFFD_EVENT_FORK) {

			if (ewq->msg.event == UFFD_EVENT_FORK) {

				struct userfaultfd_ctx *new;

				struct userfaultfd_ctx *new;
@@ -1061,6 +1067,12 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, 
					(unsigned long)

					(unsigned long)

					uwq->msg.arg.reserved.reserved1;

					uwq->msg.arg.reserved.reserved1;

				list_move(&uwq->wq.entry, &fork_event);

				list_move(&uwq->wq.entry, &fork_event);

				/*

				 * fork_nctx can be freed as soon as

				 * we drop the lock, unless we take a

				 * reference on it.

				 */

				userfaultfd_ctx_get(fork_nctx);

				spin_unlock(&ctx->event_wqh.lock);

				spin_unlock(&ctx->event_wqh.lock);

				ret = 0;

				ret = 0;

				break;

				break;
@@ -1091,20 +1103,54 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait, 




	if (!ret && msg->event == UFFD_EVENT_FORK) {

	if (!ret && msg->event == UFFD_EVENT_FORK) {

		ret = resolve_userfault_fork(ctx, fork_nctx, msg);

		ret = resolve_userfault_fork(ctx, fork_nctx, msg);



		if (!ret) {

		spin_lock(&ctx->event_wqh.lock);

		spin_lock(&ctx->event_wqh.lock);

		if (!list_empty(&fork_event)) {

		if (!list_empty(&fork_event)) {

			/*

			 * The fork thread didn't abort, so we can

			 * drop the temporary refcount.

			 */

			userfaultfd_ctx_put(fork_nctx);



			uwq = list_first_entry(&fork_event,

			uwq = list_first_entry(&fork_event,

					       typeof(*uwq),

					       typeof(*uwq),

					       wq.entry);

					       wq.entry);

			/*

			 * If fork_event list wasn't empty and in turn

			 * the event wasn't already released by fork

			 * (the event is allocated on fork kernel

			 * stack), put the event back to its place in

			 * the event_wq. fork_event head will be freed

			 * as soon as we return so the event cannot

			 * stay queued there no matter the current

			 * "ret" value.

			 */

			list_del(&uwq->wq.entry);

			list_del(&uwq->wq.entry);

			__add_wait_queue(&ctx->event_wqh, &uwq->wq);

			__add_wait_queue(&ctx->event_wqh, &uwq->wq);



			/*

			 * Leave the event in the waitqueue and report

			 * error to userland if we failed to resolve

			 * the userfault fork.

			 */

			if (likely(!ret))

				userfaultfd_event_complete(ctx, uwq);

				userfaultfd_event_complete(ctx, uwq);

		} else {

			/*

			 * Here the fork thread aborted and the

			 * refcount from the fork thread on fork_nctx

			 * has already been released. We still hold

			 * the reference we took before releasing the

			 * lock above. If resolve_userfault_fork

			 * failed we've to drop it because the

			 * fork_nctx has to be freed in such case. If

			 * it succeeded we'll hold it because the new

			 * uffd references it.

			 */

			if (ret)

				userfaultfd_ctx_put(fork_nctx);

		}

		}

		spin_unlock(&ctx->event_wqh.lock);

		spin_unlock(&ctx->event_wqh.lock);

	}

	}

	}





	return ret;

	return ret;

}

}