Skip to content

Commit 86dfd78

Browse files
PlaidCatPlaidCat
committed
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
jira KERNEL-325 cve CVE-2023-53401 Rebuild_History Non-Buildable kernel-4.18.0-553.89.1.el8_10 commit-author Roman Gushchin <roman.gushchin@linux.dev> commit 3b8abb3 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.89.1.el8_10/3b8abb32.failed KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: ================================================================== BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0: drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306 refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340 obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408 memcg_slab_free_hook mm/slab.h:587 [inline] __cache_free mm/slab.c:3373 [inline] __do_kmem_cache_free mm/slab.c:3577 [inline] kmem_cache_free+0x105/0x280 mm/slab.c:3602 __d_free fs/dcache.c:298 [inline] dentry_free fs/dcache.c:375 [inline] __dentry_kill+0x422/0x4a0 fs/dcache.c:621 dentry_kill+0x8d/0x1e0 dput+0x118/0x1f0 fs/dcache.c:913 __fput+0x3bf/0x570 fs/file_table.c:329 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x123/0x160 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1: obj_stock_flush_required mm/memcontrol.c:3319 [inline] drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361 try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703 try_charge mm/memcontrol.c:2837 [inline] mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290 sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025 sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525 udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692 udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668 __sys_setsockopt+0x1c3/0x230 net/socket.c:2271 __do_sys_setsockopt net/socket.c:2282 [inline] __se_sys_setsockopt net/socket.c:2279 [inline] __x64_sys_setsockopt+0x66/0x80 net/socket.c:2279 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffff8881382d52c0 -> 0xffff888138893740 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to stock->cached_objcg. Link: https://lkml.kernel.org/r/20230502160839.361544-1-roman.gushchin@linux.dev Fixes: bf4f059 ("mm: memcg/slab: obj_cgroup API") Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev> Reported-by: syzbot+774c29891415ab0fd29d@syzkaller.appspotmail.com Reported-by: Dmitry Vyukov <dvyukov@google.com> Link: https://lore.kernel.org/linux-mm/CACT4Y+ZfucZhM60YPphWiCLJr6+SGFhT+jjm8k1P-a_8Kkxsjg@mail.gmail.com/T/#t Reviewed-by: Yosry Ahmed <yosryahmed@google.com> Acked-by: Shakeel Butt <shakeelb@google.com> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit 3b8abb3) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # mm/memcontrol.c
1 parent 6c07643 commit 86dfd78

File tree

1 file changed

+203
-0
lines changed

1 file changed

+203
-0
lines changed

‎ciq/ciq_backports/kernel-4.18.0-553.89.1.el8_10/3b8abb32.failed‎

Lines changed: 203 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,203 @@
1+
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
2+
3+
jira KERNEL-325
4+
cve CVE-2023-53401
5+
Rebuild_History Non-Buildable kernel-4.18.0-553.89.1.el8_10
6+
commit-author Roman Gushchin <roman.gushchin@linux.dev>
7+
commit 3b8abb3239530c423c0b97e42af7f7e856e1ee96
8+
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
9+
Will be included in final tarball splat. Ref for failed cherry-pick at:
10+
ciq/ciq_backports/kernel-4.18.0-553.89.1.el8_10/3b8abb32.failed
11+
12+
KCSAN found an issue in obj_stock_flush_required():
13+
stock->cached_objcg can be reset between the check and dereference:
14+
15+
==================================================================
16+
BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock
17+
18+
write to 0xffff888237c2a2f8 of 8 bytes by task 19625 on cpu 0:
19+
drain_obj_stock+0x408/0x4e0 mm/memcontrol.c:3306
20+
refill_obj_stock+0x9c/0x1e0 mm/memcontrol.c:3340
21+
obj_cgroup_uncharge+0xe/0x10 mm/memcontrol.c:3408
22+
memcg_slab_free_hook mm/slab.h:587 [inline]
23+
__cache_free mm/slab.c:3373 [inline]
24+
__do_kmem_cache_free mm/slab.c:3577 [inline]
25+
kmem_cache_free+0x105/0x280 mm/slab.c:3602
26+
__d_free fs/dcache.c:298 [inline]
27+
dentry_free fs/dcache.c:375 [inline]
28+
__dentry_kill+0x422/0x4a0 fs/dcache.c:621
29+
dentry_kill+0x8d/0x1e0
30+
dput+0x118/0x1f0 fs/dcache.c:913
31+
__fput+0x3bf/0x570 fs/file_table.c:329
32+
____fput+0x15/0x20 fs/file_table.c:349
33+
task_work_run+0x123/0x160 kernel/task_work.c:179
34+
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
35+
exit_to_user_mode_loop+0xcf/0xe0 kernel/entry/common.c:171
36+
exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:203
37+
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
38+
syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296
39+
do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
40+
entry_SYSCALL_64_after_hwframe+0x63/0xcd
41+
42+
read to 0xffff888237c2a2f8 of 8 bytes by task 19632 on cpu 1:
43+
obj_stock_flush_required mm/memcontrol.c:3319 [inline]
44+
drain_all_stock+0x174/0x2a0 mm/memcontrol.c:2361
45+
try_charge_memcg+0x6d0/0xd10 mm/memcontrol.c:2703
46+
try_charge mm/memcontrol.c:2837 [inline]
47+
mem_cgroup_charge_skmem+0x51/0x140 mm/memcontrol.c:7290
48+
sock_reserve_memory+0xb1/0x390 net/core/sock.c:1025
49+
sk_setsockopt+0x800/0x1e70 net/core/sock.c:1525
50+
udp_lib_setsockopt+0x99/0x6c0 net/ipv4/udp.c:2692
51+
udp_setsockopt+0x73/0xa0 net/ipv4/udp.c:2817
52+
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3668
53+
__sys_setsockopt+0x1c3/0x230 net/socket.c:2271
54+
__do_sys_setsockopt net/socket.c:2282 [inline]
55+
__se_sys_setsockopt net/socket.c:2279 [inline]
56+
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2279
57+
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
58+
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
59+
entry_SYSCALL_64_after_hwframe+0x63/0xcd
60+
61+
value changed: 0xffff8881382d52c0 -> 0xffff888138893740
62+
63+
Reported by Kernel Concurrency Sanitizer on:
64+
CPU: 1 PID: 19632 Comm: syz-executor.0 Not tainted 6.3.0-rc2-syzkaller-00387-g534293368afa #0
65+
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
66+
67+
Fix it by using READ_ONCE()/WRITE_ONCE() for all accesses to
68+
stock->cached_objcg.
69+
70+
Link: https://lkml.kernel.org/r/20230502160839.361544-1-roman.gushchin@linux.dev
71+
Fixes: bf4f059954dc ("mm: memcg/slab: obj_cgroup API")
72+
Signed-off-by: Roman Gushchin <roman.gushchin@linux.dev>
73+
Reported-by: syzbot+774c29891415ab0fd29d@syzkaller.appspotmail.com
74+
Reported-by: Dmitry Vyukov <dvyukov@google.com>
75+
Link: https://lore.kernel.org/linux-mm/CACT4Y+ZfucZhM60YPphWiCLJr6+SGFhT+jjm8k1P-a_8Kkxsjg@mail.gmail.com/T/#t
76+
Reviewed-by: Yosry Ahmed <yosryahmed@google.com>
77+
Acked-by: Shakeel Butt <shakeelb@google.com>
78+
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
79+
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
80+
(cherry picked from commit 3b8abb3239530c423c0b97e42af7f7e856e1ee96)
81+
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
82+
83+
# Conflicts:
84+
# mm/memcontrol.c
85+
diff --cc mm/memcontrol.c
86+
index 6e2a077af4c1,c823c35c2ed4..000000000000
87+
--- a/mm/memcontrol.c
88+
+++ b/mm/memcontrol.c
89+
@@@ -3272,8 -3208,8 +3272,13 @@@ void mod_objcg_state(struct obj_cgroup
90+
* accumulating over a page of vmstat data or when pgdat or idx
91+
* changes.
92+
*/
93+
++<<<<<<< HEAD
94+
+ if (stock->cached_objcg != objcg) {
95+
+ drain_obj_stock(stock);
96+
++=======
97+
+ if (READ_ONCE(stock->cached_objcg) != objcg) {
98+
+ old = drain_obj_stock(stock);
99+
++>>>>>>> 3b8abb323953 (mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required())
100+
obj_cgroup_get(objcg);
101+
stock->nr_bytes = atomic_read(&objcg->nr_charged_bytes)
102+
? atomic_xchg(&objcg->nr_charged_bytes, 0) : 0;
103+
@@@ -3322,11 -3260,14 +3327,18 @@@
104+
105+
static bool consume_obj_stock(struct obj_cgroup *objcg, unsigned int nr_bytes)
106+
{
107+
- struct memcg_stock_pcp *stock;
108+
unsigned long flags;
109+
+ struct obj_stock *stock = get_obj_stock(&flags);
110+
bool ret = false;
111+
112+
++<<<<<<< HEAD
113+
+ if (objcg == stock->cached_objcg && stock->nr_bytes >= nr_bytes) {
114+
++=======
115+
+ local_lock_irqsave(&memcg_stock.stock_lock, flags);
116+
+
117+
+ stock = this_cpu_ptr(&memcg_stock);
118+
+ if (objcg == READ_ONCE(stock->cached_objcg) && stock->nr_bytes >= nr_bytes) {
119+
++>>>>>>> 3b8abb323953 (mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required())
120+
stock->nr_bytes -= nr_bytes;
121+
ret = true;
122+
}
123+
@@@ -3336,12 -3277,12 +3348,12 @@@
124+
return ret;
125+
}
126+
127+
-static struct obj_cgroup *drain_obj_stock(struct memcg_stock_pcp *stock)
128+
+static void drain_obj_stock(struct obj_stock *stock)
129+
{
130+
- struct obj_cgroup *old = stock->cached_objcg;
131+
+ struct obj_cgroup *old = READ_ONCE(stock->cached_objcg);
132+
133+
if (!old)
134+
- return NULL;
135+
+ return;
136+
137+
if (stock->nr_bytes) {
138+
unsigned int nr_pages = stock->nr_bytes >> PAGE_SHIFT;
139+
@@@ -3383,22 -3332,22 +3395,37 @@@
140+
stock->cached_pgdat = NULL;
141+
}
142+
143+
++<<<<<<< HEAD
144+
+ obj_cgroup_put(old);
145+
+ stock->cached_objcg = NULL;
146+
++=======
147+
+ WRITE_ONCE(stock->cached_objcg, NULL);
148+
+ /*
149+
+ * The `old' objects needs to be released by the caller via
150+
+ * obj_cgroup_put() outside of memcg_stock_pcp::stock_lock.
151+
+ */
152+
+ return old;
153+
++>>>>>>> 3b8abb323953 (mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required())
154+
}
155+
156+
static bool obj_stock_flush_required(struct memcg_stock_pcp *stock,
157+
struct mem_cgroup *root_memcg)
158+
{
159+
+ struct obj_cgroup *objcg = READ_ONCE(stock->cached_objcg);
160+
struct mem_cgroup *memcg;
161+
162+
++<<<<<<< HEAD
163+
+ if (in_task() && stock->task_obj.cached_objcg) {
164+
+ memcg = obj_cgroup_memcg(stock->task_obj.cached_objcg);
165+
+ if (memcg && mem_cgroup_is_descendant(memcg, root_memcg))
166+
+ return true;
167+
+ }
168+
+ if (stock->irq_obj.cached_objcg) {
169+
+ memcg = obj_cgroup_memcg(stock->irq_obj.cached_objcg);
170+
++=======
171+
+ if (objcg) {
172+
+ memcg = obj_cgroup_memcg(objcg);
173+
++>>>>>>> 3b8abb323953 (mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required())
174+
if (memcg && mem_cgroup_is_descendant(memcg, root_memcg))
175+
return true;
176+
}
177+
@@@ -3409,14 -3358,18 +3436,22 @@@
178+
static void refill_obj_stock(struct obj_cgroup *objcg, unsigned int nr_bytes,
179+
bool allow_uncharge)
180+
{
181+
- struct memcg_stock_pcp *stock;
182+
- struct obj_cgroup *old = NULL;
183+
unsigned long flags;
184+
+ struct obj_stock *stock = get_obj_stock(&flags);
185+
unsigned int nr_pages = 0;
186+
187+
++<<<<<<< HEAD
188+
+ if (stock->cached_objcg != objcg) { /* reset if necessary */
189+
+ drain_obj_stock(stock);
190+
++=======
191+
+ local_lock_irqsave(&memcg_stock.stock_lock, flags);
192+
+
193+
+ stock = this_cpu_ptr(&memcg_stock);
194+
+ if (READ_ONCE(stock->cached_objcg) != objcg) { /* reset if necessary */
195+
+ old = drain_obj_stock(stock);
196+
++>>>>>>> 3b8abb323953 (mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required())
197+
obj_cgroup_get(objcg);
198+
- stock->cached_objcg = objcg;
199+
+ WRITE_ONCE(stock->cached_objcg, objcg);
200+
stock->nr_bytes = atomic_read(&objcg->nr_charged_bytes)
201+
? atomic_xchg(&objcg->nr_charged_bytes, 0) : 0;
202+
allow_uncharge = true; /* Allow uncharge when objcg changes */
203+
* Unmerged path mm/memcontrol.c

0 commit comments

Comments
 (0)