In commit 720c24192404 ("ANDROID: binder: change down_write to
down_read") binder assumed the mmap read lock is sufficient to protect
alloc->vma inside binder_update_page_range(). This used to be accurate
until commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in
munmap"), which now downgrades the mmap_lock after detaching the vma
from the rbtree in munmap(). Then it proceeds to teardown and free the
vma with only the read lock held.
This means that accesses to alloc->vma in binder_update_page_range() now
will race with vm_area_free() in munmap() and can cause a UAF as shown
in the following KASAN trace:
==================================================================
BUG: KASAN: use-after-free in vm_insert_page+0x7c/0x1f0
Read of size 8 at addr ffff16204ad00600 by task server/558
CPU: 3 PID: 558 Comm: server Not tainted 5.10.150-00001-gdc8dcf942daa #1
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x0/0x2a0
show_stack+0x18/0x2c
dump_stack+0xf8/0x164
print_address_description.constprop.0+0x9c/0x538
kasan_report+0x120/0x200
__asan_load8+0xa0/0xc4
vm_insert_page+0x7c/0x1f0
binder_update_page_range+0x278/0x50c
binder_alloc_new_buf+0x3f0/0xba0
binder_transaction+0x64c/0x3040
binder_thread_write+0x924/0x2020
binder_ioctl+0x1610/0x2e5c
__arm64_sys_ioctl+0xd4/0x120
el0_svc_common.constprop.0+0xac/0x270
do_el0_svc+0x38/0xa0
el0_svc+0x1c/0x2c
el0_sync_handler+0xe8/0x114
el0_sync+0x180/0x1c0
Allocated by task 559:
kasan_save_stack+0x38/0x6c
__kasan_kmalloc.constprop.0+0xe4/0xf0
kasan_slab_alloc+0x18/0x2c
kmem_cache_alloc+0x1b0/0x2d0
vm_area_alloc+0x28/0x94
mmap_region+0x378/0x920
do_mmap+0x3f0/0x600
vm_mmap_pgoff+0x150/0x17c
ksys_mmap_pgoff+0x284/0x2dc
__arm64_sys_mmap+0x84/0xa4
el0_svc_common.constprop.0+0xac/0x270
do_el0_svc+0x38/0xa0
el0_svc+0x1c/0x2c
el0_sync_handler+0xe8/0x114
el0_sync+0x180/0x1c0
Freed by task 560:
kasan_save_stack+0x38/0x6c
kasan_set_track+0x28/0x40
kasan_set_free_info+0x24/0x4c
__kasan_slab_free+0x100/0x164
kasan_slab_free+0x14/0x20
kmem_cache_free+0xc4/0x34c
vm_area_free+0x1c/0x2c
remove_vma+0x7c/0x94
__do_munmap+0x358/0x710
__vm_munmap+0xbc/0x130
__arm64_sys_munmap+0x4c/0x64
el0_svc_common.constprop.0+0xac/0x270
do_el0_svc+0x38/0xa0
el0_svc+0x1c/0x2c
el0_sync_handler+0xe8/0x114
el0_sync+0x180/0x1c0
[...]
==================================================================
To prevent the race above, revert back to taking the mmap write lock
inside binder_update_page_range(). One might expect an increase of mmap
lock contention. However, binder already serializes these calls via top
level alloc->mutex. Also, there was no performance impact shown when
running the binder benchmark tests.
Note this patch is specific to stable branches 5.4 and 5.10. Since in
newer kernel releases binder no longer caches a pointer to the vma.
Instead, it has been refactored to use vma_lookup() which avoids the
issue described here. This switch was introduced in commit a43cfc87caaf
("android: binder: stop saving a pointer to the VMA").
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Reported-by: Jann Horn <jannh(a)google.com>
Cc: <stable(a)vger.kernel.org> # 5.4.x
Cc: Minchan Kim <minchan(a)kernel.org>
Cc: Yang Shi <yang.shi(a)linux.alibaba.com>
Cc: Liam Howlett <liam.howlett(a)oracle.com>
Signed-off-by: Carlos Llamas <cmllamas(a)google.com>
---
drivers/android/binder_alloc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index b5022a7f6bae..7e48ed7c9c8e 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -212,7 +212,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
mm = alloc->vma_vm_mm;
if (mm) {
- down_read(&mm->mmap_sem);
+ down_write(&mm->mmap_sem);
vma = alloc->vma;
}
@@ -271,7 +271,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
/* vm_insert_page does not seem to increment the refcount */
}
if (mm) {
- up_read(&mm->mmap_sem);
+ up_write(&mm->mmap_sem);
mmput(mm);
}
return 0;
@@ -304,7 +304,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
}
err_no_vma:
if (mm) {
- up_read(&mm->mmap_sem);
+ up_write(&mm->mmap_sem);
mmput(mm);
}
return vma ? -ENOMEM : -ESRCH;
--
2.38.1.431.g37b22c650d-goog
This is the start of the stable review cycle for the 4.19.264 release.
There are 78 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.264-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.264-rc1
Biju Das <biju.das.jz(a)bp.renesas.com>
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
Hyong Youb Kim <hyonkim(a)cisco.com>
net/mlx5e: Do not increment ESN when updating IPsec ESN state
Yang Yingliang <yangyingliang(a)huawei.com>
net: ehea: fix possible memory leak in ehea_register_port()
Aaron Conole <aconole(a)redhat.com>
openvswitch: switch from WARN to pr_warn
Takashi Iwai <tiwai(a)suse.de>
ALSA: aoa: Fix I2S device accounting
Yang Yingliang <yangyingliang(a)huawei.com>
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
Sudeep Holla <sudeep.holla(a)arm.com>
PM: domains: Fix handling of unavailable/disabled idle states
Yang Yingliang <yangyingliang(a)huawei.com>
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
Slawomir Laba <slawomirx.laba(a)intel.com>
i40e: Fix flow-type by setting GL_HASH_INSET registers
Sylwester Dziedziuch <sylwesterx.dziedziuch(a)intel.com>
i40e: Fix VF hang when reset is triggered on another VF
Slawomir Laba <slawomirx.laba(a)intel.com>
i40e: Fix ethtool rx-flow-hash setting for X722
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: v4l2-dv-timings: add sanity checks for blanking values
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: dev->bitmap_cap wasn't freed in all cases
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: s_fbuf: add more sanity checks
Mario Limonciello <mario.limonciello(a)amd.com>
PM: hibernate: Allow hybrid sleep to work with s2idle
Dongliang Mu <dzm91(a)hust.edu.cn>
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
Neal Cardwell <ncardwell(a)google.com>
tcp: fix indefinite deferral of RTO with SACK reneging
Zhang Changzhong <zhangchangzhong(a)huawei.com>
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
Zhengchao Shao <shaozhengchao(a)huawei.com>
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
Eric Dumazet <edumazet(a)google.com>
kcm: annotate data-races around kcm->rx_wait
Eric Dumazet <edumazet(a)google.com>
kcm: annotate data-races around kcm->rx_psock
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: add the bit rate quirk for Molex cables
Raju Rangoju <Raju.Rangoju(a)amd.com>
amd-xgbe: fix the SFP compliance codes check for DAC cables
Chen Zhongjin <chenzhongjin(a)huawei.com>
x86/unwind/orc: Fix unreliable stack dump with gcov
Yang Yingliang <yangyingliang(a)huawei.com>
net: netsec: fix error handling in netsec_register_mdio()
Xin Long <lucien.xin(a)gmail.com>
tipc: fix a null-ptr-deref in tipc_topsrv_accept
Yang Yingliang <yangyingliang(a)huawei.com>
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
Randy Dunlap <rdunlap(a)infradead.org>
arc: iounmap() arg is volatile
Nathan Huckleberry <nhuck(a)google.com>
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
Wei Yongjun <weiyongjun1(a)huawei.com>
net: ieee802154: fix error return code in dgram_bind()
Rik van Riel <riel(a)surriel.com>
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
M. Vefa Bicakci <m.v.b(a)runbox.com>
xen/gntdev: Prevent leaking grants
Jan Beulich <jbeulich(a)suse.com>
Xen/gntdev: don't ignore kernel unmapping error
Heiko Carstens <hca(a)linux.ibm.com>
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
Adrian Hunter <adrian.hunter(a)intel.com>
perf auxtrace: Fix address filter symbol name match for modules
Christian A. Ehrhardt <lk(a)c--e.de>
kernfs: fix use-after-free in __kernfs_remove
Matthew Ma <mahongwei(a)zeku.com>
mmc: core: Fix kernel panic when remove non-standard SDIO card
Johan Hovold <johan+linaro(a)kernel.org>
drm/msm/hdmi: fix memory corruption with too many bridges
Johan Hovold <johan+linaro(a)kernel.org>
drm/msm/dsi: fix memory corruption with too many bridges
Miquel Raynal <miquel.raynal(a)bootlin.com>
mac802154: Fix LQI recording
Hyunwoo Kim <imv4bel(a)gmail.com>
fbdev: smscufx: Fix several use-after-free bugs
Shreeya Patel <shreeya.patel(a)collabora.com>
iio: light: tsl2583: Fix module unloading
Matti Vaittinen <mazziesaccount(a)gmail.com>
tools: iio: iio_utils: fix digit calculation
Mathias Nyman <mathias.nyman(a)linux.intel.com>
xhci: Remove device endpoints from bandwidth list when freeing the device
Jens Glathe <jens.glathe(a)oldschoolsolutions.biz>
usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
Justin Chen <justinpopo6(a)gmail.com>
usb: bdc: change state when port disconnected
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Don't set IMI for no_interrupt
Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
usb: dwc3: gadget: Stop processing more requests on IMI
Hannu Hartikainen <hannu(a)hrtk.in>
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
Jason A. Donenfeld <Jason(a)zx2c4.com>
ALSA: au88x0: use explicitly signed char
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ALSA: Use del_timer_sync() before freeing timer
Anssi Hannula <anssi.hannula(a)bitwise.fi>
can: kvaser_usb: Fix possible completions during init_completion
Seth Jenkins <sethjenkins(a)google.com>
mm: /proc/pid/smaps_rollup: fix no vma's null-deref
Gaurav Kohli <gauravkohli(a)linux.microsoft.com>
hv_netvsc: Fix race between VF offering and VF association message from host
Nick Desaulniers <ndesaulniers(a)google.com>
Makefile.debug: re-enable debug info for .S files
Werner Sembach <wse(a)tuxedocomputers.com>
ACPI: video: Force backlight native for more TongFang devices
Chen-Yu Tsai <wenst(a)chromium.org>
media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls
Jerry Snitselaar <jsnitsel(a)redhat.com>
iommu/vt-d: Clean up si_domain in the init_dmars() error path
Yang Yingliang <yangyingliang(a)huawei.com>
net: hns: fix possible memory leak in hnae_ae_register()
Zhengchao Shao <shaozhengchao(a)huawei.com>
net: sched: cake: fix null pointer access issue when cake_init() fails
Xiaobo Liu <cppcoffee(a)gmail.com>
net/atm: fix proc_mpc_write incorrect return value
José Expósito <jose.exposito89(a)gmail.com>
HID: magicmouse: Do not set BTN_MOUSE on double report
Alexander Potapenko <glider(a)google.com>
tipc: fix an information leak in tipc_topsrv_kern_subscr
Mark Tomlinson <mark.tomlinson(a)alliedtelesis.co.nz>
tipc: Fix recognition of trial period
Tony Luck <tony.luck(a)intel.com>
ACPI: extlog: Handle multiple records
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix processing of delayed tree block refs during backref walking
Filipe Manana <fdmanana(a)suse.com>
btrfs: fix processing of delayed data refs during backref walking
Jean-Francois Le Fillatre <jflf_kernel(a)gmx.com>
r8152: add PID for the Lenovo OneLink+ Dock
James Morse <james.morse(a)arm.com>
arm64: errata: Remove AES hwcap for COMPAT tasks
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
media: venus: dec: Handle the case where find_format fails
Eric Ren <renzhengeek(a)gmail.com>
KVM: arm64: vgic: Fix exit condition in scan_its_table()
Kai-Heng Feng <kai.heng.feng(a)canonical.com>
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
Alexander Stein <alexander.stein(a)ew.tq-group.com>
ata: ahci-imx: Fix MODULE_ALIAS
Zhang Rui <rui.zhang(a)intel.com>
hwmon/coretemp: Handle large core ID value
Borislav Petkov <bp(a)suse.de>
x86/microcode/AMD: Apply the patch early on every logical thread
Joseph Qi <joseph.qi(a)linux.alibaba.com>
ocfs2: fix BUG when iput after ocfs2_mknod fails
Joseph Qi <joseph.qi(a)linux.alibaba.com>
ocfs2: clear dinode links count in case of error
-------------
Diffstat:
Documentation/arm64/silicon-errata.txt | 2 +
Makefile | 8 +-
arch/arc/include/asm/io.h | 2 +-
arch/arc/mm/ioremap.c | 2 +-
arch/arm64/Kconfig | 16 ++++
arch/arm64/include/asm/cpucaps.h | 3 +-
arch/arm64/kernel/cpu_errata.c | 17 ++++
arch/arm64/kernel/cpufeature.c | 13 ++-
arch/s390/include/asm/futex.h | 3 +-
arch/x86/kernel/cpu/microcode/amd.c | 16 +++-
arch/x86/kernel/unwind_orc.c | 2 +-
drivers/acpi/acpi_extlog.c | 33 ++++---
drivers/acpi/video_detect.c | 64 +++++++++++++
drivers/ata/ahci.h | 2 +-
drivers/ata/ahci_imx.c | 2 +-
drivers/base/power/domain.c | 4 +
.../gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c | 5 +-
drivers/gpu/drm/msm/dsi/dsi.c | 6 ++
drivers/gpu/drm/msm/hdmi/hdmi.c | 5 ++
drivers/hid/hid-magicmouse.c | 2 +-
drivers/hwmon/coretemp.c | 56 ++++++++----
drivers/iio/light/tsl2583.c | 2 +-
drivers/iommu/intel-iommu.c | 5 ++
drivers/media/platform/qcom/venus/vdec.c | 2 +
drivers/media/platform/vivid/vivid-core.c | 22 +++++
drivers/media/platform/vivid/vivid-core.h | 2 +
drivers/media/platform/vivid/vivid-vid-cap.c | 27 ++++--
drivers/media/v4l2-core/v4l2-dv-timings.c | 14 +++
drivers/media/v4l2-core/v4l2-mem2mem.c | 62 +++++++++----
drivers/mmc/core/sdio_bus.c | 3 +-
drivers/net/can/mscan/mpc5xxx_can.c | 8 +-
drivers/net/can/rcar/rcar_canfd.c | 6 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +-
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +-
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 17 ++--
drivers/net/ethernet/hisilicon/hns/hnae.c | 4 +-
drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 100 ++++++++++++---------
drivers/net/ethernet/intel/i40e/i40e_type.h | 4 +
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 43 ++++++---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 +
drivers/net/ethernet/lantiq_etop.c | 1 -
.../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 -
drivers/net/ethernet/micrel/ksz884x.c | 2 +-
drivers/net/ethernet/socionext/netsec.c | 2 +
drivers/net/hyperv/hyperv_net.h | 3 +
drivers/net/hyperv/netvsc.c | 4 +
drivers/net/hyperv/netvsc_drv.c | 20 +++++
drivers/net/usb/cdc_ether.c | 7 ++
drivers/net/usb/r8152.c | 1 +
drivers/usb/core/quirks.c | 9 ++
drivers/usb/dwc3/gadget.c | 8 +-
drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 +
drivers/usb/host/xhci-mem.c | 20 +++--
drivers/usb/host/xhci-pci.c | 8 +-
drivers/video/fbdev/smscufx.c | 55 ++++++------
drivers/xen/gntdev.c | 30 +++++--
fs/btrfs/backref.c | 46 ++++++----
fs/kernfs/dir.c | 5 +-
fs/ocfs2/namei.c | 23 +++--
fs/proc/task_mmu.c | 2 +-
include/uapi/linux/videodev2.h | 3 +-
kernel/power/hibernate.c | 2 +-
mm/hugetlb.c | 2 +-
net/atm/mpoa_proc.c | 3 +-
net/core/net_namespace.c | 7 ++
net/ieee802154/socket.c | 4 +-
net/ipv4/tcp_input.c | 3 +-
net/kcm/kcmsock.c | 23 +++--
net/mac802154/rx.c | 5 +-
net/openvswitch/datapath.c | 3 +-
net/sched/sch_cake.c | 4 +
net/tipc/discover.c | 2 +-
net/tipc/topsrv.c | 18 ++--
sound/aoa/soundbus/i2sbus/core.c | 7 +-
sound/pci/ac97/ac97_codec.c | 1 +
sound/pci/au88x0/au88x0.h | 6 +-
sound/pci/au88x0/au88x0_core.c | 2 +-
sound/synth/emux/emux.c | 7 +-
tools/iio/iio_utils.c | 4 +
tools/perf/util/auxtrace.c | 10 ++-
virt/kvm/arm/vgic/vgic-its.c | 5 +-
82 files changed, 718 insertions(+), 247 deletions(-)
Dear ,
Please can I have your attention and possibly help me for humanity's
sake please. I am writing this message with a heavy heart filled with
sorrows and sadness.
Please if you can respond, i have an issue that i will be most
grateful if you could help me deal with it please.
Susan