Commit 5ec57610 authored Feb 17, 2025 by Lorenzo Stoakes Committed by Wupeng Ma Feb 17, 2025

mm: avoid unsafe VMA hook invocation when error arises on mmap hook

stable inclusion
from stable-v5.10.231
commit f68a0236337e39b77e0c4976fb80f0b680d8d652
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB7051
CVE: CVE-2024-53096

Reference: https://lore.kernel.org/linux-mm/99f72d6dc52835126ca6d2e79732d397f6bfa20b.1731670097.git.lorenzo.stoakes@oracle.com/T/

--------------------------------

[ Upstream commit 3dd6ed34ce1f2356a77fb88edafb5ec96784e3cf ]

Patch series "fix error handling in mmap_region() and refactor
(hotfixes)", v4.

mmap_region() is somewhat terrifying, with spaghetti-like control flow and
numerous means by which issues can arise and incomplete state, memory
leaks and other unpleasantness can occur.

A large amount of the complexity arises from trying to handle errors late
in the process of mapping a VMA, which forms the basis of recently
observed issues with resource leaks and observable inconsistent state.

This series goes to great lengths to simplify how mmap_region() works and
to avoid unwinding errors late on in the process of setting up the VMA for
the new mapping, and equally avoids such operations occurring while the
VMA is in an inconsistent state.

The patches in this series comprise the minimal changes required to
resolve existing issues in mmap_region() error handling, in order that
they can be hotfixed and backported.  There is additionally a follow up
series which goes further, separated out from the v1 series and sent and
updated separately.

This patch (of 5):

After an attempted mmap() fails, we are no longer in a situation where we
can safely interact with VMA hooks.  This is currently not enforced,
meaning that we need complicated handling to ensure we do not incorrectly
call these hooks.

We can avoid the whole issue by treating the VMA as suspect the moment
that the file->f_ops->mmap() function reports an error by replacing
whatever VMA operations were installed with a dummy empty set of VMA
operations.

We do so through a new helper function internal to mm - mmap_file() -
which is both more logically named than the existing call_mmap() function
and correctly isolates handling of the vm_op reassignment to mm.

All the existing invocations of call_mmap() outside of mm are ultimately
nested within the call_mmap() from mm, which we now replace.

It is therefore safe to leave call_mmap() in place as a convenience
    function (and to avoid churn).  The invokers are:

     ovl_file_operations -> mmap -> ovl_mmap() -> backing_file_mmap()
    coda_file_operations -> mmap -> coda_file_mmap()
     shm_file_operations -> shm_mmap()
shm_file_operations_huge -> shm_mmap()
            dma_buf_fops -> dma_buf_mmap_internal -> i915_dmabuf_ops
                            -> i915_gem_dmabuf_mmap()

None of these callers interact with vm_ops or mappings in a problematic
way on error, quickly exiting out.

Link: https://lkml.kernel.org/r/cover.1730224667.git.lorenzo.stoakes@oracle.com
Link: https://lkml.kernel.org/r/d41fd763496fd0048a962f3fd9407dc72dd4fd86.1730224667.git.lorenzo.stoakes@oracle.com


Fixes: deb0f656 ("mm/mmap: undo ->mmap() when arch_validate_flags() fails")
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reported-by: Jann Horn <jannh@google.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Jann Horn <jannh@google.com>
Cc: Andreas Larsson <andreas@gaisler.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Helge Deller <deller@gmx.de>
Cc: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Will Deacon <will@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ma Wupeng <mawupeng1@huawei.com>

parent e804018e

mm/internal.h

+12 −0

Original line number	Diff line number	Diff line
		@@ -49,6 +49,18 @@

		void page_writeback_init(void);

		/*
		* This is a file-backed mapping, and is about to be memory mapped - invoke its
		* mmap hook and safely handle error conditions. On error, VMA hooks will be
		* mutated.
		*
		* @file: File which backs the mapping.
		* @vma: VMA which we are mapping.
		*
		* Returns: 0 if success, error otherwise.
		*/
		int mmap_file(struct file file, struct vm_area_struct vma);

		vm_fault_t do_swap_page(struct vm_fault *vmf);

		void free_pgtables(struct mmu_gather tlb, struct vm_area_struct start_vma,

mm/mmap.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1865,7 +1865,7 @@ static unsigned long __mmap_region(struct mm_struct mm, struct file file,
		* new file must not have been exposed to user-space, yet.
		*/
		vma->vm_file = get_file(file);
		error = call_mmap(file, vma);
		error = mmap_file(file, vma);
		if (error)
		goto unmap_and_free_vma;

		@@ -1880,7 +1880,7 @@ static unsigned long __mmap_region(struct mm_struct mm, struct file file,

		addr = vma->vm_start;

		/* If vm_flags changed after call_mmap(), we should try merge vma again
		/* If vm_flags changed after mmap_file(), we should try merge vma again
		* as we may succeed this time.
		*/
		if (unlikely(vm_flags != vma->vm_flags && prev)) {

mm/nommu.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -955,7 +955,7 @@ static int do_mmap_shared_file(struct vm_area_struct *vma)
		{
		int ret;

		ret = call_mmap(vma->vm_file, vma);
		ret = mmap_file(vma->vm_file, vma);
		if (ret == 0) {
		vma->vm_region->vm_top = vma->vm_region->vm_end;
		return 0;
		@@ -986,7 +986,7 @@ static int do_mmap_private(struct vm_area_struct *vma,
		* - VM_MAYSHARE will be set if it may attempt to share
		*/
		if (capabilities & NOMMU_MAP_DIRECT) {
		ret = call_mmap(vma->vm_file, vma);
		ret = mmap_file(vma->vm_file, vma);
		if (ret == 0) {
		/* shouldn't return success if we're not sharing */
		BUG_ON(!(vma->vm_flags & VM_MAYSHARE));

mm/util.c

+18 −0

Original line number	Diff line number	Diff line
		@@ -1079,3 +1079,21 @@ int __weak memcmp_pages(struct page page1, struct page page2)
		kunmap_atomic(addr1);
		return ret;
		}

		int mmap_file(struct file file, struct vm_area_struct vma)
		{
		static const struct vm_operations_struct dummy_vm_ops = {};
		int err = call_mmap(file, vma);

		if (likely(!err))
		return 0;

		/*
		* OK, we tried to call the file hook for mmap(), but an error
		* arose. The mapping is in an inconsistent state and we most not invoke
		* any further hooks on it.
		*/
		vma->vm_ops = &dummy_vm_ops;

		return err;
		}