Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c131f751 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Linus Torvalds
Browse files

khugepaged: fix use-after-free in collapse_huge_page() 

hugepage_vma_revalidate() tries to re-check if we still should try to
collapse small pages into huge one after the re-acquiring mmap_sem.

The problem Dmitry Vyukov reported[1] is that the vma found by
hugepage_vma_revalidate() can be suitable for huge pages, but not the
same vma we had before dropping mmap_sem.  And dereferencing original
vma can lead to fun results..

Let's use vma hugepage_vma_revalidate() found instead of assuming it's the
same as what we had before the lock was dropped.

[1] http://lkml.kernel.org/r/CACT4Y+Z3gigBvhca9kRJFcjX0G70V_nRhbwKBU+yGoESBDKi9Q@mail.gmail.com

Link: http://lkml.kernel.org/r/20160907122559.GA6542@black.fi.intel.com


Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Reviewed-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
Cc: Ebru Akagunduz <ebru.akagunduz@gmail.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Sasha Levin <levinsasha928@gmail.com>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Suleiman Souhlal <suleiman@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: David Rientjes <rientjes@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d8e38754

mm/khugepaged.c

+8 −7
Original line number Original line Diff line number Diff line
@@ -838,7 +838,8 @@ static bool hugepage_vma_check(struct vm_area_struct *vma) 
 * value (scan code).

 * value (scan code).

 */

 */





static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address)

static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address,

		struct vm_area_struct **vmap)

{

{

	struct vm_area_struct *vma;

	struct vm_area_struct *vma;

	unsigned long hstart, hend;

	unsigned long hstart, hend;
@@ -846,7 +847,7 @@ static int hugepage_vma_revalidate(struct mm_struct *mm, unsigned long address) 
	if (unlikely(khugepaged_test_exit(mm)))

	if (unlikely(khugepaged_test_exit(mm)))

		return SCAN_ANY_PROCESS;

		return SCAN_ANY_PROCESS;





	vma = find_vma(mm, address);

	*vmap = vma = find_vma(mm, address);

	if (!vma)

	if (!vma)

		return SCAN_VMA_NULL;

		return SCAN_VMA_NULL;
@@ -898,7 +899,7 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, 
		/* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */

		/* do_swap_page returns VM_FAULT_RETRY with released mmap_sem */

		if (ret & VM_FAULT_RETRY) {

		if (ret & VM_FAULT_RETRY) {

			down_read(&mm->mmap_sem);

			down_read(&mm->mmap_sem);

			if (hugepage_vma_revalidate(mm, address)) {

			if (hugepage_vma_revalidate(mm, address, &fe.vma)) {

				/* vma is no longer available, don't continue to swapin */

				/* vma is no longer available, don't continue to swapin */

				trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);

				trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0);

				return false;

				return false;
@@ -923,7 +924,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, 
static void collapse_huge_page(struct mm_struct *mm,

static void collapse_huge_page(struct mm_struct *mm,

				   unsigned long address,

				   unsigned long address,

				   struct page **hpage,

				   struct page **hpage,

				   struct vm_area_struct *vma,

				   int node, int referenced)

				   int node, int referenced)

{

{

	pmd_t *pmd, _pmd;

	pmd_t *pmd, _pmd;
@@ -933,6 +933,7 @@ static void collapse_huge_page(struct mm_struct *mm, 
	spinlock_t *pmd_ptl, *pte_ptl;

	spinlock_t *pmd_ptl, *pte_ptl;

	int isolated = 0, result = 0;

	int isolated = 0, result = 0;

	struct mem_cgroup *memcg;

	struct mem_cgroup *memcg;

	struct vm_area_struct *vma;

	unsigned long mmun_start;	/* For mmu_notifiers */

	unsigned long mmun_start;	/* For mmu_notifiers */

	unsigned long mmun_end;		/* For mmu_notifiers */

	unsigned long mmun_end;		/* For mmu_notifiers */

	gfp_t gfp;

	gfp_t gfp;
@@ -961,7 +962,7 @@ static void collapse_huge_page(struct mm_struct *mm, 
	}

	}





	down_read(&mm->mmap_sem);

	down_read(&mm->mmap_sem);

	result = hugepage_vma_revalidate(mm, address);

	result = hugepage_vma_revalidate(mm, address, &vma);

	if (result) {

	if (result) {

		mem_cgroup_cancel_charge(new_page, memcg, true);

		mem_cgroup_cancel_charge(new_page, memcg, true);

		up_read(&mm->mmap_sem);

		up_read(&mm->mmap_sem);
@@ -994,7 +995,7 @@ static void collapse_huge_page(struct mm_struct *mm, 
	 * handled by the anon_vma lock + PG_lock.

	 * handled by the anon_vma lock + PG_lock.

	 */

	 */

	down_write(&mm->mmap_sem);

	down_write(&mm->mmap_sem);

	result = hugepage_vma_revalidate(mm, address);

	result = hugepage_vma_revalidate(mm, address, &vma);

	if (result)

	if (result)

		goto out;

		goto out;

	/* check if the pmd is still valid */

	/* check if the pmd is still valid */
@@ -1202,7 +1203,7 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, 
	if (ret) {

	if (ret) {

		node = khugepaged_find_target_node();

		node = khugepaged_find_target_node();

		/* collapse_huge_page will return with the mmap_sem released */

		/* collapse_huge_page will return with the mmap_sem released */

		collapse_huge_page(mm, address, hpage, vma, node, referenced);

		collapse_huge_page(mm, address, hpage, node, referenced);

	}

	}

out:

out:

	trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,

	trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced,