leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
bfd40eaff5
linux/drivers/char
History
Kirill A. Shutemov bfd40eaff5 mm: fix vma_is_anonymous() false-positives 
vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
VMA.  This is unreliable as ->mmap may not set ->vm_ops.

False-positive vma_is_anonymous() may lead to crashes:

	next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
	prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
	pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
	flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
	------------[ cut here ]------------
	kernel BUG at mm/memory.c:1422!
	invalid opcode: 0000 [#1] SMP KASAN
	CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
	Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
	01/01/2011
	RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
	RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
	RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
	RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
	Call Trace:
	 unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
	 zap_page_range_single+0x3cc/0x580 mm/memory.c:1644
	 unmap_mapping_range_vma mm/memory.c:2792 [inline]
	 unmap_mapping_range_tree mm/memory.c:2813 [inline]
	 unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845
	 unmap_mapping_range+0x48/0x60 mm/memory.c:2880
	 truncate_pagecache+0x54/0x90 mm/truncate.c:800
	 truncate_setsize+0x70/0xb0 mm/truncate.c:826
	 simple_setattr+0xe9/0x110 fs/libfs.c:409
	 notify_change+0xf13/0x10f0 fs/attr.c:335
	 do_truncate+0x1ac/0x2b0 fs/open.c:63
	 do_sys_ftruncate+0x492/0x560 fs/open.c:205
	 __do_sys_ftruncate fs/open.c:215 [inline]
	 __se_sys_ftruncate fs/open.c:213 [inline]
	 __x64_sys_ftruncate+0x59/0x80 fs/open.c:213
	 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reproducer:

	#include <stdio.h>
	#include <stddef.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <sys/ioctl.h>
	#include <sys/mman.h>
	#include <unistd.h>
	#include <fcntl.h>

	#define KCOV_INIT_TRACE			_IOR('c', 1, unsigned long)
	#define KCOV_ENABLE			_IO('c', 100)
	#define KCOV_DISABLE			_IO('c', 101)
	#define COVER_SIZE			(1024<<10)

	#define KCOV_TRACE_PC  0
	#define KCOV_TRACE_CMP 1

	int main(int argc, char **argv)
	{
		int fd;
		unsigned long *cover;

		system("mount -t debugfs none /sys/kernel/debug");
		fd = open("/sys/kernel/debug/kcov", O_RDWR);
		ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE);
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
		munmap(cover, COVER_SIZE * sizeof(unsigned long));
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
		memset(cover, 0, COVER_SIZE * sizeof(unsigned long));
		ftruncate(fd, 3UL << 20);
		return 0;
	}

This can be fixed by assigning anonymous VMAs own vm_ops and not relying
on it being NULL.

If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
dummy_vm_ops.  This way we will have non-NULL ->vm_ops for all VMAs.

Link: http://lkml.kernel.org/r/20180724121139.62570-4-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: syzbot+3f84280d52be9b7083cc@syzkaller.appspotmail.com
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-07-26 19:38:03 -07:00
..
agp char: amd64-agp: Use 64-bit arithmetic instead of 32-bit 2018-07-10 13:50:31 +10:00
hw_random hwrng: core - Always drop the RNG in hwrng_unregister() 2018-06-15 23:06:49 +08:00
ipmi ipmi: kcs_bmc: fix IRQ exception if the channel is not open 2018-06-24 18:11:39 -05:00
mwave char/mwave: make some arrays static const to make object code smaller 2017-07-17 17:23:16 +02:00
pcmcia tty: replace ->proc_fops with ->proc_show 2018-05-16 07:24:30 +02:00
tpm treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
xilinx_hwicap char: xilinx_hwicap: Fix warnings in the driver 2017-08-28 17:04:47 +02:00
xillybus PCI: Add Altera vendor ID 2018-03-14 19:13:47 +01:00
adi.c char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
apm-emulation.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
applicom.c applicom: constify pci_device_id. 2017-08-28 17:11:28 +02:00
applicom.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
bsr.c
ds1620.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
dsp56k.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
dtlk.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
efirtc.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
generic_nvram.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
hangcheck-timer.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
hpet.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
Kconfig docs: Fix some broken references 2018-06-15 18:10:01 -03:00
lp.c char: lp: use true or false for boolean values 2018-01-25 10:56:02 +01:00
Makefile char: sparc64: Add privileged ADI driver 2018-06-05 11:24:55 -07:00
mbcs.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
mbcs.h
mem.c mm: fix vma_is_anonymous() false-positives 2018-07-26 19:38:03 -07:00
misc.c proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
mspec.c char: mspec: change return type to vm_fault_t 2018-04-23 13:51:53 +02:00
nsc_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
nvram.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
nwbutton.c treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwbutton.h treewide: Switch DEFINE_TIMER callbacks to struct timer_list * 2017-11-21 15:57:05 -08:00
nwflash.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
pc8736x_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
powernv-op-panel.c powerpc/powernv: Add driver for operator panel on FSP machines 2016-06-29 17:33:46 +10:00
ppdev.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
ps3flash.c
random.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
raw.c treewide: Use array_size() in vzalloc() 2018-06-12 16:19:22 -07:00
rtc.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
scx200_gpio.c Replace <asm/uaccess.h> with <linux/uaccess.h> globally 2016-12-24 11:46:01 -08:00
snsc_event.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h> 2017-03-02 08:42:29 +01:00
snsc.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
snsc.h
sonypi.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
tb0219.c mips: separate extable.h, switch module.h to it 2016-10-05 18:36:18 -04:00
tlclk.c timer: Remove last user of TIMER_INITIALIZER 2017-10-05 15:01:18 +02:00
toshiba.c proc: introduce proc_create_single{,_data} 2018-05-16 07:23:35 +02:00
ttyprintk.c ttyprintk: Neaten and simplify printing 2016-09-13 17:30:17 +02:00
uv_mmtimer.c
virtio_console.c treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00