|
 |
f23e92f |
From 5f00110f7273f9ff04ac69a5f85bb535a4fd0987 Mon Sep 17 00:00:00 2001
|
|
|
f23e92f |
From: Greg Thelen <gthelen@google.com>
|
|
|
f23e92f |
Date: Fri, 22 Feb 2013 16:36:01 -0800
|
|
|
f23e92f |
Subject: [PATCH] tmpfs: fix use-after-free of mempolicy object
|
|
|
f23e92f |
|
|
|
f23e92f |
The tmpfs remount logic preserves filesystem mempolicy if the mpol=M
|
|
|
f23e92f |
option is not specified in the remount request. A new policy can be
|
|
|
f23e92f |
specified if mpol=M is given.
|
|
|
f23e92f |
|
|
|
f23e92f |
Before this patch remounting an mpol bound tmpfs without specifying
|
|
|
f23e92f |
mpol= mount option in the remount request would set the filesystem's
|
|
|
f23e92f |
mempolicy object to a freed mempolicy object.
|
|
|
f23e92f |
|
|
|
f23e92f |
To reproduce the problem boot a DEBUG_PAGEALLOC kernel and run:
|
|
|
f23e92f |
# mkdir /tmp/x
|
|
|
f23e92f |
|
|
|
f23e92f |
# mount -t tmpfs -o size=100M,mpol=interleave nodev /tmp/x
|
|
|
f23e92f |
|
|
|
f23e92f |
# grep /tmp/x /proc/mounts
|
|
|
f23e92f |
nodev /tmp/x tmpfs rw,relatime,size=102400k,mpol=interleave:0-3 0 0
|
|
|
f23e92f |
|
|
|
f23e92f |
# mount -o remount,size=200M nodev /tmp/x
|
|
|
f23e92f |
|
|
|
f23e92f |
# grep /tmp/x /proc/mounts
|
|
|
f23e92f |
nodev /tmp/x tmpfs rw,relatime,size=204800k,mpol=??? 0 0
|
|
|
f23e92f |
# note ? garbage in mpol=... output above
|
|
|
f23e92f |
|
|
|
f23e92f |
# dd if=/dev/zero of=/tmp/x/f count=1
|
|
|
f23e92f |
# panic here
|
|
|
f23e92f |
|
|
|
f23e92f |
Panic:
|
|
|
f23e92f |
BUG: unable to handle kernel NULL pointer dereference at (null)
|
|
|
f23e92f |
IP: [< (null)>] (null)
|
|
|
f23e92f |
[...]
|
|
|
f23e92f |
Oops: 0010 [#1] SMP DEBUG_PAGEALLOC
|
|
|
f23e92f |
Call Trace:
|
|
|
f23e92f |
mpol_shared_policy_init+0xa5/0x160
|
|
|
f23e92f |
shmem_get_inode+0x209/0x270
|
|
|
f23e92f |
shmem_mknod+0x3e/0xf0
|
|
|
f23e92f |
shmem_create+0x18/0x20
|
|
|
f23e92f |
vfs_create+0xb5/0x130
|
|
|
f23e92f |
do_last+0x9a1/0xea0
|
|
|
f23e92f |
path_openat+0xb3/0x4d0
|
|
|
f23e92f |
do_filp_open+0x42/0xa0
|
|
|
f23e92f |
do_sys_open+0xfe/0x1e0
|
|
|
f23e92f |
compat_sys_open+0x1b/0x20
|
|
|
f23e92f |
cstar_dispatch+0x7/0x1f
|
|
|
f23e92f |
|
|
|
f23e92f |
Non-debug kernels will not crash immediately because referencing the
|
|
|
f23e92f |
dangling mpol will not cause a fault. Instead the filesystem will
|
|
|
f23e92f |
reference a freed mempolicy object, which will cause unpredictable
|
|
|
f23e92f |
behavior.
|
|
|
f23e92f |
|
|
|
f23e92f |
The problem boils down to a dropped mpol reference below if
|
|
|
f23e92f |
shmem_parse_options() does not allocate a new mpol:
|
|
|
f23e92f |
|
|
|
f23e92f |
config = *sbinfo
|
|
|
f23e92f |
shmem_parse_options(data, &config, true)
|
|
|
f23e92f |
mpol_put(sbinfo->mpol)
|
|
|
f23e92f |
sbinfo->mpol = config.mpol /* BUG: saves unreferenced mpol */
|
|
|
f23e92f |
|
|
|
f23e92f |
This patch avoids the crash by not releasing the mempolicy if
|
|
|
f23e92f |
shmem_parse_options() doesn't create a new mpol.
|
|
|
f23e92f |
|
|
|
f23e92f |
How far back does this issue go? I see it in both 2.6.36 and 3.3. I did
|
|
|
f23e92f |
not look back further.
|
|
|
f23e92f |
|
|
|
f23e92f |
Signed-off-by: Greg Thelen <gthelen@google.com>
|
|
|
f23e92f |
Acked-by: Hugh Dickins <hughd@google.com>
|
|
|
f23e92f |
Cc: <stable@vger.kernel.org>
|
|
|
f23e92f |
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
|
|
f23e92f |
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
f23e92f |
---
|
|
|
f23e92f |
mm/shmem.c | 10 ++++++++--
|
|
|
f23e92f |
1 file changed, 8 insertions(+), 2 deletions(-)
|
|
|
f23e92f |
|
|
|
f23e92f |
diff --git a/mm/shmem.c b/mm/shmem.c
|
|
|
f23e92f |
index 7162c58..5e2ff59 100644
|
|
|
f23e92f |
--- a/mm/shmem.c
|
|
|
f23e92f |
+++ b/mm/shmem.c
|
|
|
f23e92f |
@@ -2486,6 +2486,7 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
|
|
|
f23e92f |
unsigned long inodes;
|
|
|
f23e92f |
int error = -EINVAL;
|
|
|
f23e92f |
|
|
|
f23e92f |
+ config.mpol = NULL;
|
|
|
f23e92f |
if (shmem_parse_options(data, &config, true))
|
|
|
f23e92f |
return error;
|
|
|
f23e92f |
|
|
|
f23e92f |
@@ -2510,8 +2511,13 @@ static int shmem_remount_fs(struct super_block *sb, int *flags, char *data)
|
|
|
f23e92f |
sbinfo->max_inodes = config.max_inodes;
|
|
|
f23e92f |
sbinfo->free_inodes = config.max_inodes - inodes;
|
|
|
f23e92f |
|
|
|
f23e92f |
- mpol_put(sbinfo->mpol);
|
|
|
f23e92f |
- sbinfo->mpol = config.mpol; /* transfers initial ref */
|
|
|
f23e92f |
+ /*
|
|
|
f23e92f |
+ * Preserve previous mempolicy unless mpol remount option was specified.
|
|
|
f23e92f |
+ */
|
|
|
f23e92f |
+ if (config.mpol) {
|
|
|
f23e92f |
+ mpol_put(sbinfo->mpol);
|
|
|
f23e92f |
+ sbinfo->mpol = config.mpol; /* transfers initial ref */
|
|
|
f23e92f |
+ }
|
|
|
f23e92f |
out:
|
|
|
f23e92f |
spin_unlock(&sbinfo->stat_lock);
|
|
|
f23e92f |
return error;
|
|
|
f23e92f |
--
|
|
|
f23e92f |
1.8.1.2
|
|
|
f23e92f |
|