Kirill A. Shutemov
bfd40eaff5
mm: fix vma_is_anonymous() false-positives
vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
VMA. This is unreliable as ->mmap may not set ->vm_ops.
False-positive vma_is_anonymous() may lead to crashes:
next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
------------[ cut here ]------------
kernel BUG at mm/memory.c:1422!
invalid opcode: 0000 [#1] SMP KASAN
CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
Call Trace:
unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
zap_page_range_single+0x3cc/0x580 mm/memory.c:1644
unmap_mapping_range_vma mm/memory.c:2792 [inline]
unmap_mapping_range_tree mm/memory.c:2813 [inline]
unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845
unmap_mapping_range+0x48/0x60 mm/memory.c:2880
truncate_pagecache+0x54/0x90 mm/truncate.c:800
truncate_setsize+0x70/0xb0 mm/truncate.c:826
simple_setattr+0xe9/0x110 fs/libfs.c:409
notify_change+0xf13/0x10f0 fs/attr.c:335
do_truncate+0x1ac/0x2b0 fs/open.c:63
do_sys_ftruncate+0x492/0x560 fs/open.c:205
__do_sys_ftruncate fs/open.c:215 [inline]
__se_sys_ftruncate fs/open.c:213 [inline]
__x64_sys_ftruncate+0x59/0x80 fs/open.c:213
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Reproducer:
#include <stdio.h>
#include <stddef.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <unistd.h>
#include <fcntl.h>
#define KCOV_INIT_TRACE _IOR('c', 1, unsigned long)
#define KCOV_ENABLE _IO('c', 100)
#define KCOV_DISABLE _IO('c', 101)
#define COVER_SIZE (1024<<10)
#define KCOV_TRACE_PC 0
#define KCOV_TRACE_CMP 1
int main(int argc, char **argv)
{
int fd;
unsigned long *cover;
system("mount -t debugfs none /sys/kernel/debug");
fd = open("/sys/kernel/debug/kcov", O_RDWR);
ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE);
cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
munmap(cover, COVER_SIZE * sizeof(unsigned long));
cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
memset(cover, 0, COVER_SIZE * sizeof(unsigned long));
ftruncate(fd, 3UL << 20);
return 0;
}
This can be fixed by assigning anonymous VMAs own vm_ops and not relying
on it being NULL.
If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
dummy_vm_ops. This way we will have non-NULL ->vm_ops for all VMAs.
Link: http://lkml.kernel.org/r/20180724121139.62570-4-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: syzbot+3f84280d52be9b7083cc@syzkaller.appspotmail.com
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-07-26 19:38:03 -07:00
..
2018-07-23 13:39:33 +02:00
2018-06-06 13:49:25 -07:00
2018-06-12 16:19:22 -07:00
2018-07-02 13:18:22 -07:00
2018-06-30 21:24:18 +09:00
2018-06-12 16:19:22 -07:00
2018-07-26 09:25:03 -07:00
2018-06-04 10:58:12 -07:00
2018-07-06 19:13:42 -07:00
2018-06-17 08:38:55 +09:00
2018-07-02 04:24:44 -07:00
2018-06-12 16:19:22 -07:00
2018-07-26 19:38:03 -07:00
2018-07-11 09:34:25 -07:00
2018-07-10 22:12:47 +02:00
2018-06-06 18:39:49 -07:00
2018-07-24 10:44:57 +02:00
2018-06-07 10:23:33 -07:00
2018-06-24 06:31:54 +08:00
2018-07-13 10:54:01 -07:00
2018-06-12 16:19:22 -07:00
2018-06-28 11:57:21 +05:30
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-06-22 10:58:27 +02:00
2018-06-12 16:19:22 -07:00
2018-07-07 16:55:22 +02:00
2018-06-12 16:19:22 -07:00
2018-07-22 12:04:51 -07:00
2018-07-09 17:16:11 -07:00
2018-06-12 16:19:22 -07:00
2018-06-16 16:40:36 -07:00
2018-06-11 12:09:19 -07:00
2018-06-12 16:19:22 -07:00
2018-07-13 15:34:29 -07:00
2018-06-12 16:19:22 -07:00
2018-06-24 14:50:52 +01:00
2018-07-13 12:42:14 -07:00
2018-06-27 09:16:53 -07:00
2018-07-20 13:55:56 +02:00
2018-06-12 16:19:22 -07:00
2018-06-22 14:22:02 +02:00
2018-06-28 10:40:47 -07:00
2018-06-12 16:19:22 -07:00
2018-06-24 06:33:54 +08:00
2018-06-07 10:23:33 -07:00
2018-06-12 16:19:22 -07:00
2018-07-20 14:24:17 -07:00
2018-06-26 11:28:38 +02:00
2018-06-12 18:28:00 -07:00
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-06-14 16:21:46 +09:00
2018-07-22 12:04:51 -07:00
2018-07-09 11:17:47 +02:00
2018-07-03 10:01:44 +02:00
2018-07-24 16:38:01 -07:00
2018-06-25 21:36:45 +08:00
2018-06-12 18:28:00 -07:00
2018-06-05 16:20:22 -07:00
2018-07-13 10:54:01 -07:00
2018-07-20 07:43:59 -07:00
2018-07-07 17:30:25 +02:00
2018-07-16 08:41:32 -06:00
2018-06-19 15:53:32 +05:30
2018-06-12 16:19:22 -07:00
2018-06-04 10:58:12 -07:00
2018-06-15 18:10:01 -03:00
2018-07-19 11:54:04 -07:00
2018-06-12 16:19:22 -07:00
2018-06-18 17:48:42 +01:00
2018-06-29 12:00:22 +05:30
2018-07-14 12:47:04 +02:00
2018-07-20 15:29:59 +03:00
2018-06-07 12:34:37 -07:00
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-07-18 15:25:25 -07:00
2018-06-14 16:25:43 +09:00
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-06-15 07:55:25 +09:00
2018-06-12 18:28:00 -07:00
2018-06-04 12:35:03 -07:00
2018-07-13 10:37:54 +02:00
2018-07-06 09:14:34 -07:00
2018-06-15 18:10:01 -03:00
2018-07-22 12:04:51 -07:00
2018-06-12 16:19:22 -07:00
2018-06-12 16:19:22 -07:00
2018-07-19 15:09:59 -07:00
2018-06-15 18:11:26 -03:00
2018-06-12 16:19:22 -07:00
2018-07-26 09:26:41 -07:00
2018-06-19 21:36:37 -04:00
2018-06-12 18:28:00 -07:00
2018-07-07 17:29:17 +02:00
2018-06-28 21:34:39 +09:00
2018-07-07 16:57:35 +02:00
2018-07-21 08:38:29 +02:00
2018-06-12 16:19:22 -07:00
2018-07-21 16:46:53 -07:00
2018-06-23 10:23:49 +09:00
2018-06-17 05:25:18 +09:00
2018-06-12 16:19:22 -07:00
2018-06-16 06:35:02 +09:00
2018-06-05 16:20:22 -07:00
2018-06-12 12:56:02 -07:00
2018-06-23 20:44:11 +08:00
2018-06-06 17:27:14 -07:00