Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 04:06:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

arm64: mte: Avoid the racy walk of the vma list during core dump

Browse Source 
The MTE coredump code in arch/arm64/kernel/elfcore.c iterates over the
vma list without the mmap_lock held. This can race with another process
or userfaultfd concurrently modifying the vma list. Change the
for_each_mte_vma macro and its callers to instead use the vma snapshot
taken by dump_vma_snapshot() and stored in the cprm object.

Fixes: 6dd8b1a0b6 ("arm64: mte: Dump the MTE tags in the core file")
Cc: <stable@vger.kernel.org> # 5.18.x
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reported-by: Seth Jenkins <sethjenkins@google.com>
Suggested-by: Seth Jenkins <sethjenkins@google.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221222181251.1345752-4-catalin.marinas@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
This commit is contained in:
Catalin Marinas 2022-12-22 18:12:51 +00:00 committed by Will Deacon
parent 19e183b545
commit 4f4c549feb
1 changed files with 26 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
arch/arm64/kernel/elfcore.c
View File

@ -8,28 +8,27 @@
#include <asm/cpufeature.h> #include <asm/cpufeature.h>
#include <asm/mte.h> #include <asm/mte.h>
#define for_each_mte_vma(vmi, vma) \ #define for_each_mte_vma(cprm, i, m) \
if (system_supports_mte()) \ if (system_supports_mte()) \
for_each_vma(vmi, vma) \ for (i = 0, m = cprm->vma_meta; \
if (vma->vm_flags & VM_MTE) i < cprm->vma_count; \
i++, m = cprm->vma_meta + i) \
if (m->flags & VM_MTE)
static unsigned long mte_vma_tag_dump_size(struct vm_area_struct *vma) static unsigned long mte_vma_tag_dump_size(struct core_vma_metadata *m)
{ {
if (vma->vm_flags & VM_DONTDUMP) return (m->dump_size >> PAGE_SHIFT) * MTE_PAGE_TAG_STORAGE;
return 0;
return vma_pages(vma) * MTE_PAGE_TAG_STORAGE;
} }
/* Derived from dump_user_range(); start/end must be page-aligned */ /* Derived from dump_user_range(); start/end must be page-aligned */
static int mte_dump_tag_range(struct coredump_params *cprm, static int mte_dump_tag_range(struct coredump_params *cprm,
unsigned long start, unsigned long end) unsigned long start, unsigned long len)
{ {
int ret = 1; int ret = 1;
unsigned long addr; unsigned long addr;
void *tags = NULL; void *tags = NULL;
for (addr = start; addr < end; addr += PAGE_SIZE) { for (addr = start; addr < start + len; addr += PAGE_SIZE) {
struct page *page = get_dump_page(addr); struct page *page = get_dump_page(addr);
/* /*
@ -78,11 +77,11 @@ static int mte_dump_tag_range(struct coredump_params *cprm,
Elf_Half elf_core_extra_phdrs(struct coredump_params *cprm) Elf_Half elf_core_extra_phdrs(struct coredump_params *cprm)
{ {
struct vm_area_struct *vma; int i;
struct core_vma_metadata *m;
int vma_count = 0; int vma_count = 0;
VMA_ITERATOR(vmi, current->mm, 0);
for_each_mte_vma(vmi, vma) for_each_mte_vma(cprm, i, m)
vma_count++; vma_count++;
return vma_count; return vma_count;
@ -90,18 +89,18 @@ Elf_Half elf_core_extra_phdrs(struct coredump_params *cprm)
int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset) int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
{ {
struct vm_area_struct *vma; int i;
VMA_ITERATOR(vmi, current->mm, 0); struct core_vma_metadata *m;
for_each_mte_vma(vmi, vma) { for_each_mte_vma(cprm, i, m) {
struct elf_phdr phdr; struct elf_phdr phdr;
phdr.p_type = PT_AARCH64_MEMTAG_MTE; phdr.p_type = PT_AARCH64_MEMTAG_MTE;
phdr.p_offset = offset; phdr.p_offset = offset;
phdr.p_vaddr = vma->vm_start; phdr.p_vaddr = m->start;
phdr.p_paddr = 0; phdr.p_paddr = 0;
phdr.p_filesz = mte_vma_tag_dump_size(vma); phdr.p_filesz = mte_vma_tag_dump_size(m);
phdr.p_memsz = vma->vm_end - vma->vm_start; phdr.p_memsz = m->end - m->start;
offset += phdr.p_filesz; offset += phdr.p_filesz;
phdr.p_flags = 0; phdr.p_flags = 0;
phdr.p_align = 0; phdr.p_align = 0;
@ -115,26 +114,23 @@ int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
size_t elf_core_extra_data_size(struct coredump_params *cprm) size_t elf_core_extra_data_size(struct coredump_params *cprm)
{ {
struct vm_area_struct *vma; int i;
struct core_vma_metadata *m;
size_t data_size = 0; size_t data_size = 0;
VMA_ITERATOR(vmi, current->mm, 0);
for_each_mte_vma(vmi, vma) for_each_mte_vma(cprm, i, m)
data_size += mte_vma_tag_dump_size(vma); data_size += mte_vma_tag_dump_size(m);
return data_size; return data_size;
} }
int elf_core_write_extra_data(struct coredump_params *cprm) int elf_core_write_extra_data(struct coredump_params *cprm)
{ {
struct vm_area_struct *vma; int i;
VMA_ITERATOR(vmi, current->mm, 0); struct core_vma_metadata *m;
for_each_mte_vma(vmi, vma) { for_each_mte_vma(cprm, i, m) {
if (vma->vm_flags & VM_DONTDUMP) if (!mte_dump_tag_range(cprm, m->start, m->dump_size))
continue;
if (!mte_dump_tag_range(cprm, vma->vm_start, vma->vm_end))
return 0; return 0;
} }