Re: [syzbot] [crypto?] KASAN: slab-use-after-free Read in handle_mm_fault

[Suren Baghdasaryan <surenb@google.com>]

On Thu, Jul 18, 2024 at 4:36 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> On Thu, Jul 18, 2024 at 04:23:47PM +0000, Suren Baghdasaryan wrote:
> > On Thu, Jul 18, 2024 at 4:20 PM Suren Baghdasaryan <surenb@google.com> wrote:
> > >
> > > On Thu, Jul 18, 2024 at 3:43 PM Liam R. Howlett <Liam.Howlett@oracle.com> wrote:
> > > >
> > > > * Vlastimil Babka (SUSE) <vbabka@kernel.org> [240718 07:00]:
> > > > > On 7/16/24 10:29 AM, syzbot wrote:
> > > > > > Hello,
> > > > >
> > > > > dunno about the [crypto?] parts, sounds rather something for Suren or Liam
> > > > > or maybe it's due to some changes to gup?
> > > >
> > > > Yes, that crypto part is very odd.
> > > >
> > > > >
> > > > > > syzbot found the following issue on:
> > > > > >
> > > > > > HEAD commit:    3fe121b62282 Add linux-next specific files for 20240712
> > > > > > git tree:       linux-next
> > > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1097ebed980000
> > > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=98dd8c4bab5cdce
> > > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=4c882a4a0697c4a25364
> > > > > > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> > > > > > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11d611a5980000
> > > > > > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13ce3259980000
> > > > > >
> > > > > > Downloadable assets:
> > > > > > disk image: https://storage.googleapis.com/syzbot-assets/8c6fbf69718d/disk-3fe121b6.raw.xz
> > > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/39fc7e43dfc1/vmlinux-3fe121b6.xz
> > > > > > kernel image: https://storage.googleapis.com/syzbot-assets/0a78e70e4b4e/bzImage-3fe121b6.xz
> > > > > > mounted in repro: https://storage.googleapis.com/syzbot-assets/66cfe5a679f2/mount_0.gz
> > > > > >
> > > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > > > Reported-by: syzbot+4c882a4a0697c4a25364@syzkaller.appspotmail.com
> > > > > >
> > > > > > ==================================================================
> > > > > > BUG: KASAN: slab-use-after-free in handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842
> > > > > > Read of size 8 at addr ffff88802c4719d0 by task syz-executor125/5235
> > > > > >
> > > > > > CPU: 1 UID: 0 PID: 5235 Comm: syz-executor125 Not tainted 6.10.0-rc7-next-20240712-syzkaller #0
> > > > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
> > > > > > Call Trace:
> > > > > >  <TASK>
> > > > > >  __dump_stack lib/dump_stack.c:94 [inline]
> > > > > >  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
> > > > > >  print_address_description mm/kasan/report.c:377 [inline]
> > > > > >  print_report+0x169/0x550 mm/kasan/report.c:488
> > > > > >  kasan_report+0x143/0x180 mm/kasan/report.c:601
> > > > > >  handle_mm_fault+0x14f0/0x19a0 mm/memory.c:5842
> > > >
> > > > /*
> > > >  * By the time we get here, we already hold the mm semaphore
> > > >  *
> > > >  * The mmap_lock may have been released depending on flags and our
> > > >  * return value.  See filemap_fault() and __folio_lock_or_retry().
> > > >  */
> > > >
> > > > Somehow we are here without an RCU or mmap_lock held?
> > >
> > > I'm guessing we did enter handle_mm_fault() with mmap_lock held but
> > > __handle_mm_fault() dropped it before returning, see the comment for
> > > __handle_mm_fault():
> > >
> > > /*
> > >  * On entry, we hold either the VMA lock or the mmap_lock
> > >  * (FAULT_FLAG_VMA_LOCK tells you which).  If VM_FAULT_RETRY is set in
> > >  * the result, the mmap_lock is not held on exit.  See filemap_fault()
> > >  * and __folio_lock_or_retry().
> > >  */
> > >
> > > So after that there is nothing that guarantees VMA is not destroyed
> > > from under us and if (vma->vm_flags & VM_DROPPABLE) check is unsafe.
> > > Hillf's suggestion should fix this issue but we need to figure out how
> > > to make this path more robust. Currently it's very easy to make a
> > > similar mistake. Maybe a WARNING comment after __handle_mm_fault()
> > > that VMA might be unstable after that function and should not be used?
> >
> > CC'ing Jason.
>
> Thanks for bringing this to my attention. I'll incorporate Hillf's patch
> and also add a comment as you suggested. Something like the below?
>
> diff --git a/mm/memory.c b/mm/memory.c
> index 18fe893ce96d..f596a8d508ef 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -5660,6 +5660,7 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
>         /* If the fault handler drops the mmap_lock, vma may be freed */
>         struct mm_struct *mm = vma->vm_mm;
>         vm_fault_t ret;
> +       bool is_droppable;
>
>         __set_current_state(TASK_RUNNING);
>
> @@ -5674,6 +5675,8 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
>                 goto out;
>         }
>
> +       is_droppable = !!(vma->vm_flags & VM_DROPPABLE);
> +
>         /*
>          * Enable the memcg OOM handling for faults triggered in user
>          * space.  Kernel faults are handled more gracefully.
> @@ -5688,10 +5691,15 @@ vm_fault_t handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
>         else
>                 ret = __handle_mm_fault(vma, address, flags);
>
> +       /*
> +        * It is no longer safe to dereference vma-> after this point, as
> +        * __handle_mm_fault may have already destroyed it.

__handle_mm_fault does not really destroy the vma. It might drop
mmap_lock and another task might destroy it from under us.

> +        */
> +
>         lru_gen_exit_fault();
>
> -       /* If the mapping is droppable, then errors due to OOM aren't fatal. */
> -       if (vma->vm_flags & VM_DROPPABLE)
> +       /* If the mapping is is_droppable, then errors due to OOM aren't fatal. */
> +       if (is_droppable)
>                 ret &= ~VM_FAULT_OOM;
>
>         if (flags & FAULT_FLAG_USER) {
>