Files
linux/include/linux
Mike Kravetz 574a6db80f hugetlb: fix null-ptr-deref in hugetlb_vma_lock_write
commit 187da0f8250aa94bd96266096aef6f694e0b4cd2 upstream.

The routine __vma_private_lock tests for the existence of a reserve map
associated with a private hugetlb mapping.  A pointer to the reserve map
is in vma->vm_private_data.  __vma_private_lock was checking the pointer
for NULL.  However, it is possible that the low bits of the pointer could
be used as flags.  In such instances, vm_private_data is not NULL and not
a valid pointer.  This results in the null-ptr-deref reported by syzbot:

general protection fault, probably for non-canonical address 0xdffffc000000001d:
 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
CPU: 0 PID: 5048 Comm: syz-executor139 Not tainted 6.6.0-rc7-syzkaller-00142-g88
8cf78c29e2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 1
0/09/2023
RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5004
...
Call Trace:
 <TASK>
 lock_acquire kernel/locking/lockdep.c:5753 [inline]
 lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5718
 down_write+0x93/0x200 kernel/locking/rwsem.c:1573
 hugetlb_vma_lock_write mm/hugetlb.c:300 [inline]
 hugetlb_vma_lock_write+0xae/0x100 mm/hugetlb.c:291
 __hugetlb_zap_begin+0x1e9/0x2b0 mm/hugetlb.c:5447
 hugetlb_zap_begin include/linux/hugetlb.h:258 [inline]
 unmap_vmas+0x2f4/0x470 mm/memory.c:1733
 exit_mmap+0x1ad/0xa60 mm/mmap.c:3230
 __mmput+0x12a/0x4d0 kernel/fork.c:1349
 mmput+0x62/0x70 kernel/fork.c:1371
 exit_mm kernel/exit.c:567 [inline]
 do_exit+0x9ad/0x2a20 kernel/exit.c:861
 __do_sys_exit kernel/exit.c:991 [inline]
 __se_sys_exit kernel/exit.c:989 [inline]
 __x64_sys_exit+0x42/0x50 kernel/exit.c:989
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Mask off low bit flags before checking for NULL pointer.  In addition, the
reserve map only 'belongs' to the OWNER (parent in parent/child
relationships) so also check for the OWNER flag.

Link: https://lkml.kernel.org/r/20231114012033.259600-1-mike.kravetz@oracle.com
Reported-by: syzbot+6ada951e7c0f7bc8a71e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-mm/00000000000078d1e00608d7878b@google.com/
Fixes: bf4916922c ("hugetlbfs: extend hugetlb_vma_lock to private VMAs")
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
Reviewed-by: Rik van Riel <riel@surriel.com>
Cc: Edward Adam Davis <eadavis@qq.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Tom Rix <trix@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-12-13 18:39:20 +01:00
..
2023-07-19 16:21:11 +02:00
2023-06-21 16:01:00 +02:00
2022-05-22 20:44:29 +01:00
2022-03-23 19:58:38 +01:00
2023-12-08 08:51:19 +01:00
2022-02-01 14:25:50 +02:00
2022-07-05 20:25:39 +02:00
2022-01-22 08:33:34 +02:00
2022-09-21 11:18:28 +09:00
2023-10-10 22:00:40 +02:00
2022-09-26 19:46:29 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:14 -07:00
2022-03-15 10:32:44 +01:00
2021-12-10 17:10:55 -08:00
2021-08-26 15:32:28 -04:00
2022-07-01 14:53:01 +02:00
2021-07-27 11:00:36 +02:00
2023-11-28 17:07:15 +00:00
2022-01-20 08:52:54 +02:00
2021-07-27 20:11:45 +01:00
2021-07-27 20:11:44 +01:00
2022-10-03 14:02:45 -07:00
2022-08-16 12:46:26 +02:00
2022-06-09 21:53:09 -07:00
2022-02-28 23:26:27 -08:00
2022-09-01 18:04:43 +02:00
2022-06-27 06:29:12 -06:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2022-07-17 17:31:38 -07:00
2022-10-03 14:03:19 -07:00
2022-05-02 14:06:20 -06:00
2022-01-27 13:53:26 +00:00
2022-05-03 16:09:03 -04:00
2022-06-19 10:38:26 +01:00
2022-07-27 14:04:52 +02:00
2022-09-26 19:46:18 -07:00
2023-10-10 22:00:35 +02:00
2022-04-28 23:16:14 -07:00
2022-09-26 10:13:13 -07:00
2022-08-02 12:34:04 -04:00
2023-05-30 14:03:22 +01:00
2022-09-01 17:39:49 -04:00
2023-11-20 11:51:55 +01:00
2022-05-17 13:32:46 -04:00
2022-02-09 09:24:40 -05:00
2023-11-20 11:51:50 +01:00
2022-01-12 10:14:09 -06:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2021-09-17 13:52:17 +01:00
2021-09-27 09:27:29 -04:00
2022-02-02 07:49:59 -07:00
2021-09-27 17:00:21 +02:00
2022-02-09 08:04:44 +01:00
2022-02-09 08:04:44 +01:00
2021-10-14 13:29:18 +02:00
2022-10-04 20:52:38 +02:00
2022-01-08 12:43:57 -06:00
2023-11-28 17:07:03 +00:00
2023-10-19 23:08:50 +02:00
2023-10-19 23:08:50 +02:00
2022-03-08 14:33:36 -06:00
2022-03-23 19:58:41 +01:00
2022-05-22 21:03:01 +01:00
2022-06-27 14:41:31 +02:00
2023-07-19 16:21:54 +02:00
2022-02-24 15:04:51 +00:00
2023-09-19 12:27:58 +02:00
2023-11-28 17:06:56 +00:00
2022-05-08 01:33:08 -07:00
2021-08-19 09:02:55 +09:00
2023-12-13 18:39:08 +01:00
2022-09-07 12:42:25 +01:00
2022-02-25 09:36:06 +01:00
2022-09-29 15:20:29 +02:00
2022-04-11 19:18:27 -06:00
2022-03-22 15:57:11 -07:00
2023-08-16 18:27:20 +02:00
2022-09-22 16:12:34 +02:00
2021-11-25 18:35:23 +01:00
2022-09-22 16:12:34 +02:00
2022-08-31 13:37:32 +02:00
2022-09-01 11:42:12 +01:00
2021-10-12 11:41:39 -03:00
2022-08-28 16:52:28 +01:00
2022-10-07 09:32:40 -04:00
2022-11-10 12:03:36 -07:00
2022-09-26 19:46:18 -07:00
2022-06-13 09:54:52 -07:00
2022-09-26 19:46:18 -07:00
2021-08-11 06:44:24 -04:00
2022-07-10 21:17:30 -04:00
2021-10-19 23:44:30 +08:00