futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free(). This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode. [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87 [ 151.415969] Call Trace: [ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593) Fix by adding rcu to __mpol_put().

Hao-Yu Yang committed 8 months ago

Commit 190a8c41 parent 19f94b33 files · +10 −3Browse files

Unified · Split

3 files

include/linux/mempolicy.h +1 −0
kernel/futex/core.c +1 −1
mm/mempolicy.c +8 −2

include/linux/mempolicy.h+1−0

@@ -55,6 +55,7 @@ struct mempolicy { · 54 unmodified lines
55	nodemask_t cpuset_mems_allowed; /* relative to these nodes */	55	nodemask_t cpuset_mems_allowed; /* relative to these nodes */
56	nodemask_t user_nodemask; /* nodemask passed by user */	56	nodemask_t user_nodemask; /* nodemask passed by user */
57	} w;	57	} w;
		58	struct rcu_head rcu;
58	};	59	};
59		60
60	/*	61	/*

kernel/futex/core.c+1−1

@@ -342,7 +342,7 @@ static int __futex_key_to_node(struct mm_struct *mm, unsigned long addr) · 341 unmodified lines
342	if (!vma)	342	if (!vma)
343	return FUTEX_NO_NODE;	343	return FUTEX_NO_NODE;
344		344
345	mpol = vma_policy(vma);	345	mpol = READ_ONCE(vma->vm_policy);
346	if (!mpol)	346	if (!mpol)
347	return FUTEX_NO_NODE;	347	return FUTEX_NO_NODE;
348		348

mm/mempolicy.c+8−2

 {
 	if (!atomic_dec_and_test(&pol->refcnt))
 		return;
-	kmem_cache_free(policy_cache, pol);
+	/*
+	 * Required to allow mmap_lock_speculative*() access, see for example
+	 * futex_key_to_node_opt(). All accesses are serialized by mmap_lock,
+	 * however the speculative lock section unbound by the normal lock
+	 * boundaries, requiring RCU freeing.
+	 */
+	kfree_rcu(pol, rcu);
 }
 EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
 	}
 	old = vma->vm_policy;
-	vma->vm_policy = new; /* protected by mmap_lock */
+	WRITE_ONCE(vma->vm_policy, new); /* protected by mmap_lock */
 	mpol_put(old);
 	return 0;