Andrea Arcangeli
c3f3ce049f
userfaultfd: use RCU to free the task struct when fork fails ...
The task structure is freed while get_mem_cgroup_from_mm() holds
rcu_read_lock() and dereferences mm->owner.
get_mem_cgroup_from_mm() failing fork()
---- ---
task = mm->owner
mm->owner = NULL;
free(task)
if (task) *task; /* use after free */
The fix consists in freeing the task with RCU also in the fork failure
case, exactly like it always happens for the regular exit(2) path. That
is enough to make the rcu_read_lock hold in get_mem_cgroup_from_mm()
(left side above) effective to avoid a use after free when dereferencing
the task structure.
An alternate possible fix would be to defer the delivery of the
userfaultfd contexts to the monitor until after fork() is guaranteed to
succeed. Such a change would require more changes because it would
create a strict ordering dependency where the uffd methods would need to
be called beyond the last potentially failing branch in order to be
safe. This solution as opposed only adds the dependency to common code
to set mm->owner to NULL and to free the task struct that was pointed by
mm->owner with RCU, if fork ends up failing. The userfaultfd methods
can still be called anywhere during the fork runtime and the monitor
will keep discarding orphaned "mm" coming from failed forks in userland.
This race condition couldn't trigger if CONFIG_MEMCG was set =n at build
time.
[aarcange@redhat.com: improve changelog, reduce #ifdefs per Michal]
Link: http://lkml.kernel.org/r/20190429035752.4508-1-aarcange@redhat.com
Link: http://lkml.kernel.org/r/20190325225636.11635-2-aarcange@redhat.com
Fixes: 893e26e61dsyzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Jason Gunthorpe <jgg@mellanox.com>
Cc: "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: zhong jiang <zhongjiang@huawei.com>
Cc: syzbot+cbb52e396df3e565ab02@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2019-05-14 19:52:47 -07:00
bpf: fix undefined behavior in narrow load handling
2019-05-13 02:05:50 +02:00
Merge branch 'for-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2019-05-09 13:52:12 -07:00
DMA mapping updates for 5.2
2019-05-09 08:40:55 -07:00
mm/mmu_notifier: use correct mmu_notifier events for each invalidation
2019-05-14 09:47:49 -07:00
kernel/gcov/gcc_3_4.c: use struct_size() in kzalloc()
2019-03-07 18:32:02 -08:00
Driver core/kobject patches for 5.2-rc1
2019-05-07 13:01:40 -07:00
Driver core/kobject patches for 5.2-rc1
2019-05-07 13:01:40 -07:00
Remove Mysterious Macro Intended to Obscure Weird Behaviours (mmiowb())
2019-05-06 16:57:52 -07:00
Power management updates for 5.2-rc1
2019-05-06 19:40:31 -07:00
fbdev changes for v5.1:
2019-03-15 14:22:59 -07:00
Printk changes for 5.2
2019-05-07 09:18:12 -07:00
Driver core/kobject patches for 5.2-rc1
2019-05-07 13:01:40 -07:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
2019-05-07 22:03:58 -07:00
This is the bulk of the GPIO changes for the v5.2 kernel cycle:
2019-05-11 10:54:43 -04:00
Provide in-kernel headers to make extending kernel easier
2019-04-29 16:48:03 +02:00
acct_on(): don't mess with freeze protection
2019-04-04 21:04:13 -04:00
treewide: Switch printk users from %pf and %pF to %ps and %pS, respectively
2019-04-09 14:19:06 +02:00
audit: connect LOGIN record to its syscall record
2019-03-20 20:57:48 -04:00
audit_compare_dname_path(): switch to const struct qstr *
2019-04-28 20:33:43 -04:00
audit_compare_dname_path(): switch to const struct qstr *
2019-04-28 20:33:43 -04:00
fsnotify: switch send_to_group() and ->handle_event to const struct qstr *
2019-04-26 13:51:03 -04:00
audit_compare_dname_path(): switch to const struct qstr *
2019-04-28 20:33:43 -04:00
Merge branch 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-05-07 20:03:32 -07:00
Merge branch 'work.dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-05-07 20:03:32 -07:00
backtrace-test: Simplify stack trace handling
2019-04-29 12:37:47 +02:00
kernel/configs: use .incbin directive to embed config_data.gz
2019-03-07 18:32:02 -08:00
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2019-05-06 14:50:46 -07:00
kexec: export PG_offline to VMCOREINFO
2019-03-05 21:07:14 -08:00
Merge branch 'for-5.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2019-03-07 10:11:41 -08:00
treewide: Switch printk users from %pf and %pF to %ps and %pS, respectively
2019-04-09 14:19:06 +02:00
userfaultfd: use RCU to free the task struct when fork fails
2019-05-14 19:52:47 -07:00
mm/gup: change GUP fast to use flags rather than a write 'bool'
2019-05-14 09:47:46 -07:00
Provide in-kernel headers to make extending kernel easier
2019-04-29 16:48:03 +02:00
kernel/hung_task.c: Use continuously blocked time when reporting.
2019-03-07 18:31:59 -08:00
mm/resource: Use resource_overlaps() to simplify region_intersects()
2019-04-19 12:59:36 +02:00
irq_work: Do not raise an IPI when queueing work on the local CPU
2019-04-18 14:07:52 +02:00
locking/static_key: Don't take sleeping locks in __static_key_slow_dec_deferred()
2019-04-29 08:29:21 +02:00
Remove Mysterious Macro Intended to Obscure Weird Behaviours (mmiowb())
2019-05-06 16:57:52 -07:00
kcov: convert kcov.refcount to refcount_t
2019-03-07 18:32:02 -08:00
power/suspend: Add function to disable secondaries for suspend
2019-05-03 19:42:41 +02:00
mm: memblock: make keeping memblock memory opt-in rather than opt-out
2019-05-14 09:47:50 -07:00
Provide in-kernel headers to make extending kernel easier
2019-04-29 16:48:03 +02:00
kprobes: Fix error check when reusing optimized probes
2019-04-16 09:38:16 +02:00
Merge branch 'akpm' (patches from Andrew)
2019-03-06 10:31:36 -08:00
latency_top: Simplify stack trace handling
2019-04-29 12:37:48 +02:00
kernel/Makefile: don't assume that kernel/gen_ikh_data.sh is executable
2019-05-14 19:52:47 -07:00
kernel/memremap.c: remove the unused device_private_entry_fault() export
2019-05-14 09:47:51 -07:00
Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2019-05-09 12:54:40 -07:00
padata: Replace padata_attr_type default_attrs field with groups
2019-04-25 22:06:11 +02:00
s390: simplify disabled_wait
2019-05-02 13:54:11 +02:00
ptrace: take into account saved_sigmask in PTRACE{GET,SET}SIGMASK
2019-03-29 10:01:37 -07:00
Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2019-03-12 13:27:20 -07:00
mm/resource: Use resource_overlaps() to simplify region_intersects()
2019-04-19 12:59:36 +02:00
rseq: Remove superfluous rseq_len from task_struct
2019-04-19 12:39:32 +02:00
audit/stable-5.2 PR 20190507
2019-05-07 19:06:04 -07:00
Merge branch 'for-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
2019-05-09 13:52:12 -07:00
softirq: Remove tasklet_hrtimer
2019-03-22 14:36:02 +01:00
stacktrace: Provide common infrastructure
2019-04-29 12:37:57 +02:00
treewide: Switch printk users from %pf and %pF to %ps and %pS, respectively
2019-04-09 14:19:06 +02:00
kernel/sys.c: prctl: fix false positive in validate_prctl_map()
2019-05-14 09:47:44 -07:00
signal: support CLONE_PIDFD with pidfd_send_signal
2019-05-07 14:31:03 +02:00
userfaultfd/sysctl: add vm.unprivileged_userfaultfd
2019-05-14 09:47:45 -07:00
genetlink: optionally validate strictly/dumps
2019-04-27 17:07:22 -04:00
torture: Don't try to offline the last CPU
2019-03-26 14:42:53 -07:00
watchdog: Fix typo in comment
2019-04-18 14:05:51 +02:00
kernel/watchdog_hld.c: hard lockup message should end with a newline
2019-04-19 09:46:05 -07:00
Merge branch 'for-5.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
2019-05-09 13:48:52 -07:00
sched/core, workqueues: Distangle worker accounting from rq lock
2019-04-16 16:55:15 +02:00
c3f3ce049f