[RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0

[RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0

[Filippo Sironi]

We've seen a number of crashes with the following signature:

    BUG: kernel NULL pointer dereference, address: 0000000000000000
    #PF: supervisor read access in kernel mode
    #PF: error_code(0x0000) - not-present page
    ...
    Oops: 0000 [#1] SMP PTI
    ...
    RIP: 0010:__rb_erase_color+0xc2/0x260
    ...
    Call Trace:
     unlink_file_vma+0x36/0x50
     free_pgtables+0x62/0x110
     exit_mmap+0xd5/0x160
     ? put_dec+0x3a/0x90
     ? num_to_str+0xa8/0xc0
     mmput+0x11/0xb0
     do_task_stat+0x940/0xc80
     proc_single_show+0x49/0x80
     ? __check_object_size+0xcc/0x1a0
     seq_read+0xd3/0x400
     vfs_read+0x72/0xb0
     ksys_read+0x9c/0xd0
     do_syscall_64+0x69/0x400
     ? schedule+0x2a/0x90
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    ...

This happens when a process goes through the tasks stats in procfs while
another is exiting.  This looks like a race where the process that's
exiting drops the last reference on the mm (with mmput) while the other
increases it (with mmget).  By only increasing when the reference isn't
0 to begin with, we prevent this from happening.

Signed-off-by: Filippo Sironi <sironi@amazon.de>
---
 kernel/fork.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index d3171e8e88e5..a7541a85e5a9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1209,10 +1209,8 @@ struct mm_struct *get_task_mm(struct task_struct *task)
 	task_lock(task);
 	mm = task->mm;
 	if (mm) {
-		if (task->flags & PF_KTHREAD)
+		if (task->flags & PF_KTHREAD || !mmget_not_zero(mm))
 			mm = NULL;
-		else
-			mmget(mm);
 	}
 	task_unlock(task);
 	return mm;
-- 
2.17.1




Amazon Development Center Germany GmbH
Krausenstr. 38
10117 Berlin
Geschaeftsfuehrung: Christian Schlaeger, Jonathan Weiss
Eingetragen am Amtsgericht Charlottenburg unter HRB 149173 B
Sitz: Berlin
Ust-ID: DE 289 237 879

Re: [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0

[Jens Axboe]

On 3/10/21 5:37 AM, Filippo Sironi wrote:
> We've seen a number of crashes with the following signature:
> 
>     BUG: kernel NULL pointer dereference, address: 0000000000000000
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     ...
>     Oops: 0000 [#1] SMP PTI
>     ...
>     RIP: 0010:__rb_erase_color+0xc2/0x260
>     ...
>     Call Trace:
>      unlink_file_vma+0x36/0x50
>      free_pgtables+0x62/0x110
>      exit_mmap+0xd5/0x160
>      ? put_dec+0x3a/0x90
>      ? num_to_str+0xa8/0xc0
>      mmput+0x11/0xb0
>      do_task_stat+0x940/0xc80
>      proc_single_show+0x49/0x80
>      ? __check_object_size+0xcc/0x1a0
>      seq_read+0xd3/0x400
>      vfs_read+0x72/0xb0
>      ksys_read+0x9c/0xd0
>      do_syscall_64+0x69/0x400
>      ? schedule+0x2a/0x90
>      entry_SYSCALL_64_after_hwframe+0x44/0xa9
>     ...
> 
> This happens when a process goes through the tasks stats in procfs while
> another is exiting.  This looks like a race where the process that's
> exiting drops the last reference on the mm (with mmput) while the other
> increases it (with mmget).  By only increasing when the reference isn't
> 0 to begin with, we prevent this from happening.

From a quick look it looks reasonable, but I don't quite see how we get
in the situation of finding a valid ->mm under task_lock() and the
mm_users count being 0? I'd like to understand that, because it may just
be that your patch just narrows the gap but it's still possible to
trigger a use-after-free. Doesn't seem like that would be possible under
exit_mm().

-- 
Jens Axboe

Re: [RFC PATCH] mm: fork: Prevent a NULL deref by getting mm only if the refcount isn't 0

[Eric W. Biederman]

Filippo Sironi <sironi@amazon.de> writes:

> We've seen a number of crashes with the following signature:
>
>     BUG: kernel NULL pointer dereference, address: 0000000000000000
>     #PF: supervisor read access in kernel mode
>     #PF: error_code(0x0000) - not-present page
>     ...
>     Oops: 0000 [#1] SMP PTI
>     ...
>     RIP: 0010:__rb_erase_color+0xc2/0x260
>     ...
>     Call Trace:
>      unlink_file_vma+0x36/0x50
>      free_pgtables+0x62/0x110
>      exit_mmap+0xd5/0x160
>      ? put_dec+0x3a/0x90
>      ? num_to_str+0xa8/0xc0
>      mmput+0x11/0xb0
>      do_task_stat+0x940/0xc80
>      proc_single_show+0x49/0x80
>      ? __check_object_size+0xcc/0x1a0
>      seq_read+0xd3/0x400
>      vfs_read+0x72/0xb0
>      ksys_read+0x9c/0xd0
>      do_syscall_64+0x69/0x400
>      ? schedule+0x2a/0x90
>      entry_SYSCALL_64_after_hwframe+0x44/0xa9
>     ...
>
> This happens when a process goes through the tasks stats in procfs while
> another is exiting.  This looks like a race where the process that's
> exiting drops the last reference on the mm (with mmput) while the other
> increases it (with mmget).  By only increasing when the reference isn't
> 0 to begin with, we prevent this from happening.

For this to be a race with exit this would require racing with exit_mm
where current->mm is cleared.

Looking at exit_mm() the code does:

	struct mm_struct *mm = current->mm;

	mmap_read_lock(mm);
	mmgrab(mm);
        task_lock(current);
	local_irq_disable();
        current->mm = NULL;
        local_irq_enable();
        task_unlock(current);
        mmap_read_unlock(mm);

	mmput(mm);

Which seems to guarantee "mm_users > 0" if "task->mm != NULL" under
tasklist_lock.

So I suggest you instrument your failing kernels and find what is
improperly decrementing mm_users.

Eric