Commit 61cc4534 authored by Waiman Long's avatar Waiman Long Committed by Peter Zijlstra
Browse files

locking/lockdep: Avoid potential access of invalid memory in lock_class 

It was found that reading /proc/lockdep after a lockdep splat may
potentially cause an access to freed memory if lockdep_unregister_key()
is called after the splat but before access to /proc/lockdep [1]. This
is due to the fact that graph_lock() call in lockdep_unregister_key()
fails after the clearing of debug_locks by the splat process.

After lockdep_unregister_key() is called, the lock_name may be freed
but the corresponding lock_class structure still have a reference to
it. That invalid memory pointer will then be accessed when /proc/lockdep
is read by a user and a use-after-free (UAF) error will be reported if
KASAN is enabled.

To fix this problem, lockdep_unregister_key() is now modified to always
search for a matching key irrespective of the debug_locks state and
zap the corresponding lock class if a matching one is found.

[1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/



Fixes: 8b39adbe ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again")
Reported-by: default avatarTetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Signed-off-by: default avatarWaiman Long <longman@redhat.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com
parent e204193b

kernel/locking/lockdep.c

+15 −9
Original line number Diff line number Diff line
@@ -6287,7 +6287,13 @@ void lockdep_reset_lock(struct lockdep_map *lock) 
		lockdep_reset_lock_reg(lock);

}



/* Unregister a dynamically allocated key. */

/*

 * Unregister a dynamically allocated key.

 *

 * Unlike lockdep_register_key(), a search is always done to find a matching

 * key irrespective of debug_locks to avoid potential invalid access to freed

 * memory in lock_class entry.

 */

void lockdep_unregister_key(struct lock_class_key *key)

{

	struct hlist_head *hash_head = keyhashentry(key);
@@ -6302,10 +6308,8 @@ void lockdep_unregister_key(struct lock_class_key *key) 
		return;



	raw_local_irq_save(flags);

	if (!graph_lock())

		goto out_irq;

	lockdep_lock();



	pf = get_pending_free();

	hlist_for_each_entry_rcu(k, hash_head, hash_entry) {

		if (k == key) {

			hlist_del_rcu(&k->hash_entry);
@@ -6313,11 +6317,13 @@ void lockdep_unregister_key(struct lock_class_key *key) 
			break;

		}

	}

	WARN_ON_ONCE(!found);

	WARN_ON_ONCE(!found && debug_locks);

	if (found) {

		pf = get_pending_free();

		__lockdep_free_key_range(pf, key, 1);

		call_rcu_zapped(pf);

	graph_unlock();

out_irq:

	}

	lockdep_unlock();

	raw_local_irq_restore(flags);



	/* Wait until is_dynamic_key() has finished accessing k->hash_entry. */