mm: check that mm is still valid in madvise()
IORING_OP_MADVISE can end up basically doing mprotect() on the VM of
another process, which means that it can race with our crazy core dump
handling which accesses the VM state without holding the mmap_sem
(because it incorrectly thinks that it is the final user).
This is clearly a core dumping problem, but we've never fixed it the
right way, and instead have the notion of "check that the mm is still
ok" using mmget_still_valid() after getting the mmap_sem for writing in
any situation where we're not the original VM thread.
See commit 04f5866e41fb ("coredump: fix race condition between
mmget_not_zero()/get_task_mm() and core dumping") for more background on
this whole mmget_still_valid() thing. You might want to have a barf bag
handy when you do.
We're discussing just fixing this properly in the only remaining core
dumping routines. But even if we do that, let's make do_madvise() do
the right thing, and then when we fix core dumping, we can remove all
these mmget_still_valid() checks.
BUG=b/174737951
TEST=presubmit
master sponge2/3596b1fc-fff5-4278-9641-40a89e0e5db0
main-R81-12871.B. sponge2/c6d1c2f1-4049-49e6-b74e-45cc92e6461a
release-R81-12871.B. sponge2/58aaf875-6ee4-40b8-bd41-4453ce420a77
SOURCE=UPSTREAM(bc0c4d1e176eeb614dc8734fc3ace34292771f11)
RELEASE_NOTE=Fixed CVE-2020-29372 in the Linux kernel.
cos-patch: lts-refresh
Reported-and-tested-by: Jann Horn <jannh@google.com>
Fixes: c1ca757bd6f4 ("io_uring: add IORING_OP_MADVISE")
Acked-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit bc0c4d1e176eeb614dc8734fc3ace34292771f11)
Signed-off-by: Saied Kazemi <saied@google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/10521
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
(cherry picked from commit 4ba52630fceea53254630ac23798c4f1891041cf)
Signed-off-by: Saied Kazemi <saied@google.com>
Change-Id: I87364fbc4b722864676b7c41fe550c6caebabb8a
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/10600
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
1 file changed
