From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89511C04FFE for ; Wed, 15 May 2024 03:10:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 19DE68D0068; Tue, 14 May 2024 23:10:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 150498D004F; Tue, 14 May 2024 23:10:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 015A98D0068; Tue, 14 May 2024 23:10:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id D618C8D004F for ; Tue, 14 May 2024 23:10:43 -0400 (EDT) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 64F2E4039D for ; Wed, 15 May 2024 03:10:43 +0000 (UTC) X-FDA: 82119152766.17.680E3B2 Received: from out-171.mta0.migadu.com (out-171.mta0.migadu.com [91.218.175.171]) by imf22.hostedemail.com (Postfix) with ESMTP id 8104BC0008 for ; Wed, 15 May 2024 03:10:41 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=R+aydqCr; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf22.hostedemail.com: domain of chengming.zhou@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1715742641; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=eV2DcCFvjQwjt5xtoWQWY0rPJ2R7dBNba4dqmpplCv4=; b=3B5oeOHBKSJqM4RMxQfLBjsDzlHDUlCd9uG/N4WlTcMuQDXmXfgNtlsmqdqhweYWJoVdbY S0GUnoeQMScHsA01+BgH7xssTWLnMFqPhoMGNW3GbV+U573s/WROc+5eM/zZstDUCJZhA3 a1HWd5/9EVMHz8+xgbFve8m0lGDpwrM= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=R+aydqCr; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf22.hostedemail.com: domain of chengming.zhou@linux.dev designates 91.218.175.171 as permitted sender) smtp.mailfrom=chengming.zhou@linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1715742641; a=rsa-sha256; cv=none; b=KUrubkR4YlbBeT3twjkAA7ydOfP5bz5lNGWLbulauYPdSIEvr67ZX5WJQ0TWRRv+Qty7XG m0SmOIgkrAUGRuuYcTPeRGWvv0bRGR3U++9xsSRh9teHyYLFXuv9ffnZOvbpkduLGq5heF V1Xhu4uvZbcUJLr0Wvy+nNkAxHaVZYg= Message-ID: <150ccdc2-48c7-40ac-b027-e8f92e2a0500@linux.dev> DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1715742639; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=eV2DcCFvjQwjt5xtoWQWY0rPJ2R7dBNba4dqmpplCv4=; b=R+aydqCrMxtqn5feQlFGxwHN8aVQ7zW44AuJnCgpm8cMEnp4udyWYt/akmKLjP0X1US8ED tefClwsErzA+irR5AJPtCdW36VXaV00G77i+Q2hRq2xWwz8lywubTC38z2EAPCflXiufPm qKykHM1XJAMu/FMJmbmlB0m/XhavcmQ= Date: Wed, 15 May 2024 11:10:32 +0800 MIME-Version: 1.0 Subject: Re: [PATCH] mm/ksm: fix possible UAF of stable_node To: David Hildenbrand , Andrew Morton , Hugh Dickins , Andrea Arcangeli , Stefan Roesch Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, zhouchengming@bytedance.com References: <20240513-b4-ksm-stable-node-uaf-v1-1-f687de76f452@linux.dev> <74a72eeb-122f-453e-baa7-63504e7c4bd8@redhat.com> Content-Language: en-US X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Chengming Zhou In-Reply-To: <74a72eeb-122f-453e-baa7-63504e7c4bd8@redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT X-Rspamd-Queue-Id: 8104BC0008 X-Stat-Signature: haqcfegumtozgcbp6wqfwyxckjmrpomw X-Rspam-User: X-Rspamd-Server: rspam11 X-HE-Tag: 1715742641-139889 X-HE-Meta: U2FsdGVkX190AirAynLho2flaMuj7lp9OT4j0BLveHHkIRnIYNhn+hWv4mY0WgOaNXp7Hil/qMZ4rFJoPS9YMnrJjK7YjeRCq0X2+D2eR+W+BOMhB7NgeyCTNkuDkr/6EdTrW6itPY+s1sHSHQnwhRG1pnm+VEI+EWfNPOKwfi6w1ypUmI/7ZvSSRhVR38pi+qLAe989x8wbTTiJzqc6WmlsUbfXwQHS7+Kvd1F3FIBe+hVjC4lnzi5OATmTiqAqLmwVt2YBkiOjP0Pyfo8IyAx4ATxSMnaDinyJfaXYrkFm3WtKrHYU9ALFsPDhXNP7a8JEQRyYK8da2RzRaSA+Qw8T6rj8nfMq7VzmOfT4Ug5gz7BrDuYFVq41QTtB6K4jZfUaozpNzFdDK5EwfEP1Ip3cuP7xm8ee9dYqj3Jdd1Yq+axEVS1WKNhZuMwEjDmk4iJS0tbpIPiaanF77HJslI3T6NrQ1joV+yLXNAgsvDVqBMS3xLQ5ccdDPLOeDu6MbECuWZS43Gmu336VIg1RXHcfLGG/nfmDHrkVJMOqmKt1inrMtSLwI7FckqHBSmdgJ7ykIJGJ5svJV//cyCMoaibMqQ+AD3aMtSSo8L0l6Fcn9GZO8lFCSum6ZfZD/To/UJbhPgYJmArqaBho7NXf34RvmeJSvL6swwaUtC9kuXfwZKsEMBr4BDui8FEyDFNABkXIs32p/b6wpsMJC/TaZuBs86/M/KiXVb5p4DARKUtL2c5HQ8obsVGP2WHYFjohdB5q0QGmeDVivoBJgTUifAc/+q9BL7KpMxKoNp/u36/OHIB5sma2Tg7mj5DryQML6SBgeJZ9IGU3nrBsHhiQv5cKJ8sCftQ0f7RBwq28hawLU1LwDDN5G5OfYjCwXZg4iCItmahDw85/egtndpAxQ1z+uu/tAFlHK++7TphrWWNweRnizYPb4ItdTEWAOHZXOdL4jaYQsOvHhZ+GYTb h+pv24rB T6tezkSudY8zk+SQc3NA7BJ94JFy0LrkuuwuWqZI92k9iYsxxUbRsqGLTJFTP4RTz4VMnexOLW+1+/9w1MQql65xzXQc136u9aFEWpUOLZNYj8BouCdnzotbgfA/7RLzatoG4iApsPrEJ0CjD/MFQCezXxA0TZiIKjb2AleVYJ9Q6ZOU+312ywCYo6w== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 2024/5/15 04:46, David Hildenbrand wrote: > On 13.05.24 05:07, Chengming Zhou wrote: >> The commit 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page >> deduplication limit") introduced a possible failure case in the >> stable_tree_insert(), where we may free the new allocated stable_node_dup >> if we fail to prepare the missing chain node. >> >> Then that kfolio return and unlock with a freed stable_node set... And >> any MM activities can come in to access kfolio->mapping, so UAF. >> >> Fix it by moving folio_set_stable_node() to the end after stable_node >> is inserted successfully. >> >> Fixes: 2c653d0ee2ae ("ksm: introduce ksm_max_page_sharing per page deduplication limit") >> Signed-off-by: Chengming Zhou >> --- >>   mm/ksm.c | 3 ++- >>   1 file changed, 2 insertions(+), 1 deletion(-) >> >> diff --git a/mm/ksm.c b/mm/ksm.c >> index e1034bf1c937..a8b76af5cf64 100644 >> --- a/mm/ksm.c >> +++ b/mm/ksm.c >> @@ -2153,7 +2153,6 @@ static struct ksm_stable_node *stable_tree_insert(struct folio *kfolio) >>         INIT_HLIST_HEAD(&stable_node_dup->hlist); >>       stable_node_dup->kpfn = kpfn; >> -    folio_set_stable_node(kfolio, stable_node_dup); >>       stable_node_dup->rmap_hlist_len = 0; >>       DO_NUMA(stable_node_dup->nid = nid); >>       if (!need_chain) { >> @@ -2172,6 +2171,8 @@ static struct ksm_stable_node *stable_tree_insert(struct folio *kfolio) >>           stable_node_chain_add_dup(stable_node_dup, stable_node); >>       } >>   +    folio_set_stable_node(kfolio, stable_node_dup); >> + >>       return stable_node_dup; > > Looks correct to me. > > We might now link the node before the folio->mapping is set up. Do we care? Don't think so. Yeah, it shouldn't be a problem, although it doesn't look very nice. Another way to fix maybe "folio_set_stable_node(folio, NULL)" in the failure case, which is safe since we have held the folio lock. > > Acked-by: David Hildenbrand > Thanks.