Commit 549bfc14 authored Jul 23, 2020 by Kirill A. Shutemov Committed by Greg Kroah-Hartman Jul 29, 2020

mm/mmap.c: close race between munmap() and expand_upwards()/downwards()



commit 246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c upstream.

VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under
mmap_read_lock().  It can lead to race with __do_munmap():

	Thread A			Thread B
__do_munmap()
  detach_vmas_to_be_unmapped()
  mmap_write_downgrade()
				expand_downwards()
				  vma->vm_start = address;
				  // The VMA now overlaps with
				  // VMAs detached by the Thread A
				// page fault populates expanded part
				// of the VMA
  unmap_region()
    // Zaps pagetables partly
    // populated by Thread B

Similar race exists for expand_upwards().

The fix is to avoid downgrading mmap_lock in __do_munmap() if detached
VMAs are next to VM_GROWSDOWN or VM_GROWSUP VMA.

[akpm@linux-foundation.org: s/mmap_sem/mmap_lock/ in comment]

Fixes: dd2283f2 ("mm: mmap: zap pages with read mmap_sem in munmap")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Yang Shi <yang.shi@linux.alibaba.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: <stable@vger.kernel.org>	[4.20+]
Link: http://lkml.kernel.org/r/20200709105309.42495-1-kirill.shutemov@linux.intel.com


Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 5835e6d5

mm/mmap.c

+14 −2

Original line number	Diff line number	Diff line
		@@ -2622,7 +2622,7 @@ static void unmap_region(struct mm_struct *mm,
		* Create a list of vma's touched by the unmap, removing them from the mm's
		* vma list as we go..
		*/
		static void
		static bool
		detach_vmas_to_be_unmapped(struct mm_struct mm, struct vm_area_struct vma,
		struct vm_area_struct *prev, unsigned long end)
		{
		@@ -2647,6 +2647,17 @@ detach_vmas_to_be_unmapped(struct mm_struct mm, struct vm_area_struct vma,

		/* Kill the cache */
		vmacache_invalidate(mm);

		/*
		* Do not downgrade mmap_lock if we are next to VM_GROWSDOWN or
		* VM_GROWSUP VMA. Such VMAs can change their size under
		* down_read(mmap_lock) and collide with the VMA we are about to unmap.
		*/
		if (vma && (vma->vm_flags & VM_GROWSDOWN))
		return false;
		if (prev && (prev->vm_flags & VM_GROWSUP))
		return false;
		return true;
		}

		/*
		@@ -2827,7 +2838,8 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
		}

		/* Detach vmas from rbtree */
		detach_vmas_to_be_unmapped(mm, vma, prev, end);
		if (!detach_vmas_to_be_unmapped(mm, vma, prev, end))
		downgrade = false;

		if (downgrade)
		downgrade_write(&mm->mmap_sem);