From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0610C43457 for ; Sat, 17 Oct 2020 23:14:18 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 915A220897 for ; Sat, 17 Oct 2020 23:14:18 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="2J556YqS" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 915A220897 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2BE6F6B0080; Sat, 17 Oct 2020 19:14:18 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2444F6B0081; Sat, 17 Oct 2020 19:14:18 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 181C06B0082; Sat, 17 Oct 2020 19:14:18 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0165.hostedemail.com [216.40.44.165]) by kanga.kvack.org (Postfix) with ESMTP id DFD9A6B0080 for ; Sat, 17 Oct 2020 19:14:17 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 8C237181AEF07 for ; Sat, 17 Oct 2020 23:14:17 +0000 (UTC) X-FDA: 77382972954.10.legs72_1c0aca227229 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin10.hostedemail.com (Postfix) with ESMTP id 67A8516A0AB for ; Sat, 17 Oct 2020 23:14:17 +0000 (UTC) X-HE-Tag: legs72_1c0aca227229 X-Filterd-Recvd-Size: 3487 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf21.hostedemail.com (Postfix) with ESMTP for ; Sat, 17 Oct 2020 23:14:17 +0000 (UTC) Received: from localhost.localdomain (c-73-231-172-41.hsd1.ca.comcast.net [73.231.172.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E683D208B6; Sat, 17 Oct 2020 23:14:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602976456; bh=3kOwiTpnCK1Bv4+1XPwqTtAubtIlwLSRR5F/+KJVms8=; h=Date:From:To:Subject:In-Reply-To:From; b=2J556YqShNJAJGEGS4R90SU++sGEP0FUvOaP09UqQ+RsiSz/LUKoo+v8AI8asZ3m1 2T5b8U2quZENka6NICO0hmXKOYWfqptB2eZSLbAZjpEcHjp5qG7khiPDJmRpN180N8 uIgCUqt8RNNstkmB4kkrpWR+xwPevDrCzacYxDcU= Date: Sat, 17 Oct 2020 16:14:15 -0700 From: Andrew Morton To: akpm@linux-foundation.org, ebiederm@xmission.com, jannh@google.com, jgg@nvidia.com, jhubbard@nvidia.com, linux-mm@kvack.org, mchehab@kernel.org, mm-commits@vger.kernel.org, sakari.ailus@linux.intel.com, torvalds@linux-foundation.org, walken@google.com Subject: [patch 13/40] binfmt_elf: take the mmap lock around find_extend_vma() Message-ID: <20201017231415.XtZWgOT7Q%akpm@linux-foundation.org> In-Reply-To: <20201017161314.88890b87fae7446ccc13c902@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jann Horn Subject: binfmt_elf: take the mmap lock around find_extend_vma() create_elf_tables() runs after setup_new_exec(), so other tasks can already access our new mm and do things like process_madvise() on it. (At the time I'm writing this commit, process_madvise() is not in mainline yet, but has been in akpm's tree for some time.) While I believe that there are currently no APIs that would actually allow another process to mess up our VMA tree (process_madvise() is limited to MADV_COLD and MADV_PAGEOUT, and uring and userfaultfd cannot reach an mm under which no syscalls have been executed yet), this seems like an accident waiting to happen. Let's make sure that we always take the mmap lock around GUP paths as long as another process might be able to see the mm. (Yes, this diff looks suspicious because we drop the lock before doing anything with `vma`, but that's because we actually don't do anything with it apart from the NULL check.) Link: https://lkml.kernel.org/r/CAG48ez1-PBCdv3y8pn-Ty-b+FmBSLwDuVKFSt8h7wARLy0dF-Q@mail.gmail.com Signed-off-by: Jann Horn Acked-by: Michel Lespinasse Cc: "Eric W . Biederman" Cc: Jason Gunthorpe Cc: John Hubbard Cc: Mauro Carvalho Chehab Cc: Sakari Ailus Signed-off-by: Andrew Morton --- fs/binfmt_elf.c | 3 +++ 1 file changed, 3 insertions(+) --- a/fs/binfmt_elf.c~binfmt_elf-take-the-mmap-lock-around-find_extend_vma +++ a/fs/binfmt_elf.c @@ -310,7 +310,10 @@ create_elf_tables(struct linux_binprm *b * Grow the stack manually; some architectures have a limit on how * far ahead a user-space access may be in order to grow the stack. */ + if (mmap_read_lock_killable(mm)) + return -EINTR; vma = find_extend_vma(mm, bprm->p); + mmap_read_unlock(mm); if (!vma) return -EFAULT; _