Commit 942341dc authored Mar 04, 2022 by Suren Baghdasaryan Committed by Linus Torvalds Mar 05, 2022

mm: fix use-after-free when anon vma name is used after vma is freed

When adjacent vmas are being merged it can result in the vma that was
originally passed to madvise_update_vma being destroyed.  In the current
implementation, the name parameter passed to madvise_update_vma points
directly to vma->anon_name and it is used after the call to vma_merge.
In the cases when vma_merge merges the original vma and destroys it,
this might result in UAF.  For that the original vma would have to hold
the anon_vma_name with the last reference.  The following vma would need
to contain a different anon_vma_name object with the same string.  Such
scenario is shown below:

madvise_vma_behavior(vma)
  madvise_update_vma(vma, ..., anon_name == vma->anon_name)
    vma_merge(vma)
      __vma_adjust(vma) <-- merges vma with adjacent one
        vm_area_free(vma) <-- frees the original vma
    replace_vma_anon_name(anon_name) <-- UAF of vma->anon_name

Fix this by raising the name refcount and stabilizing it.

Link: https://lkml.kernel.org/r/20220224231834.1481408-3-surenb@google.com
Link: https://lkml.kernel.org/r/20220223153613.835563-3-surenb@google.com


Fixes: 9a10064f ("mm: add a field to store names for private anonymous memory")
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Reported-by:  <syzbot+aa7b3d4b35f9dc46a366@syzkaller.appspotmail.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Gladkov <legion@kernel.org>
Cc: Chris Hyser <chris.hyser@oracle.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Colin Cross <ccross@google.com>
Cc: Cyrill Gorcunov <gorcunov@gmail.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Xiaofeng Cao <caoxiaofeng@yulong.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 96403e11

mm/madvise.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -131,6 +131,8 @@ static int replace_anon_vma_name(struct vm_area_struct *vma,
		/*
		* Update the vm_flags on region of a vma, splitting it or merging it as
		* necessary. Must be called with mmap_sem held for writing;
		* Caller should ensure anon_name stability by raising its refcount even when
		* anon_name belongs to a valid vma because this function might free that vma.
		*/
		static int madvise_update_vma(struct vm_area_struct *vma,
		struct vm_area_struct **prev, unsigned long start,
		@@ -945,6 +947,7 @@ static int madvise_vma_behavior(struct vm_area_struct *vma,
		unsigned long behavior)
		{
		int error;
		struct anon_vma_name *anon_name;
		unsigned long new_flags = vma->vm_flags;

		switch (behavior) {
		@@ -1010,8 +1013,11 @@ static int madvise_vma_behavior(struct vm_area_struct *vma,
		break;
		}

		anon_name = anon_vma_name(vma);
		anon_vma_name_get(anon_name);
		error = madvise_update_vma(vma, prev, start, end, new_flags,
		anon_vma_name(vma));
		anon_name);
		anon_vma_name_put(anon_name);

		out:
		/*