Revision 246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c authored by Kirill A. Shutemov on 24 July 2020, 04:15:11 UTC, committed by Linus Torvalds on 24 July 2020, 19:42:41 UTC
VMA with VM_GROWSDOWN or VM_GROWSUP flag set can change their size under mmap_read_lock(). It can lead to race with __do_munmap(): Thread A Thread B __do_munmap() detach_vmas_to_be_unmapped() mmap_write_downgrade() expand_downwards() vma->vm_start = address; // The VMA now overlaps with // VMAs detached by the Thread A // page fault populates expanded part // of the VMA unmap_region() // Zaps pagetables partly // populated by Thread B Similar race exists for expand_upwards(). The fix is to avoid downgrading mmap_lock in __do_munmap() if detached VMAs are next to VM_GROWSDOWN or VM_GROWSUP VMA. [akpm@linux-foundation.org: s/mmap_sem/mmap_lock/ in comment] Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Yang Shi <yang.shi@linux.alibaba.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: <stable@vger.kernel.org> [4.20+] Link: http://lkml.kernel.org/r/20200709105309.42495-1-kirill.shutemov@linux.intel.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent f37e99a
File | Mode | Size |
---|---|---|
apparmor | ||
bpf | ||
integrity | ||
keys | ||
loadpin | ||
lockdown | ||
safesetid | ||
selinux | ||
smack | ||
tomoyo | ||
yama | ||
Kconfig | -rw-r--r-- | 10.7 KB |
Kconfig.hardening | -rw-r--r-- | 7.9 KB |
Makefile | -rw-r--r-- | 1.3 KB |
commoncap.c | -rw-r--r-- | 39.0 KB |
device_cgroup.c | -rw-r--r-- | 21.1 KB |
inode.c | -rw-r--r-- | 10.6 KB |
lsm_audit.c | -rw-r--r-- | 10.7 KB |
min_addr.c | -rw-r--r-- | 1.3 KB |
security.c | -rw-r--r-- | 63.3 KB |
Computing file changes ...