Re: [RESEND PATCH v2 2/2] mm/kmemleak: Fix UAF bug in kmemleak_scan()

[Catalin Marinas <catalin.marinas@arm.com>]

Hi Waiman,

Thanks for your effort on trying to fix this.

On Wed, Jan 18, 2023 at 11:01:11PM -0500, Waiman Long wrote:
> @@ -567,7 +574,9 @@ static void __remove_object(struct kmemleak_object *object)
>  	rb_erase(&object->rb_node, object->flags & OBJECT_PHYS ?
>  				   &object_phys_tree_root :
>  				   &object_tree_root);
> -	list_del_rcu(&object->object_list);
> +	if (!(object->del_state & DELSTATE_NO_DELETE))
> +		list_del_rcu(&object->object_list);
> +	object->del_state |= DELSTATE_REMOVED;
>  }

So IIUC, this prevents the current object being scanned from being
removed from the list during the kmemleak_cond_resched() call.

>  /*
> @@ -633,6 +642,7 @@ static void __create_object(unsigned long ptr, size_t size,
>  	object->count = 0;			/* white color initially */
>  	object->jiffies = jiffies;
>  	object->checksum = 0;
> +	object->del_state = 0;
>  
>  	/* task information */
>  	if (in_hardirq()) {
> @@ -1470,9 +1480,22 @@ static void kmemleak_cond_resched(struct kmemleak_object *object)
>  	if (!get_object(object))
>  		return;	/* Try next object */
>  
> +	raw_spin_lock_irq(&kmemleak_lock);
> +	if (object->del_state & DELSTATE_REMOVED)
> +		goto unlock_put;	/* Object removed */
> +	object->del_state |= DELSTATE_NO_DELETE;
> +	raw_spin_unlock_irq(&kmemleak_lock);
> +
>  	rcu_read_unlock();
>  	cond_resched();
>  	rcu_read_lock();
> +
> +	raw_spin_lock_irq(&kmemleak_lock);
> +	if (object->del_state & DELSTATE_REMOVED)
> +		list_del_rcu(&object->object_list);
> +	object->del_state &= ~DELSTATE_NO_DELETE;
> +unlock_put:
> +	raw_spin_unlock_irq(&kmemleak_lock);
>  	put_object(object);
>  }

I'm not sure this was the only problem. We do have the problem that the
current object may be removed from the list, solved above, but another
scenario I had in mind is the next object being released during this
brief resched period. The RCU relies on object->next->next being valid
but, with a brief rcu_read_unlock(), the object->next could be freed,
reallocated, so object->next->next invalid.

-- 
Catalin