David Rientjes 27ae357fa8 mm, oom: fix concurrent munlock and oom reaper unmap, v3
Since exit_mmap() is done without the protection of mm->mmap_sem, it is
possible for the oom reaper to concurrently operate on an mm until
MMF_OOM_SKIP is set.

This allows munlock_vma_pages_all() to concurrently run while the oom
reaper is operating on a vma.  Since munlock_vma_pages_range() depends
on clearing VM_LOCKED from vm_flags before actually doing the munlock to
determine if any other vmas are locking the same memory, the check for
VM_LOCKED in the oom reaper is racy.

This is especially noticeable on architectures such as powerpc where
clearing a huge pmd requires serialize_against_pte_lookup().  If the pmd
is zapped by the oom reaper during follow_page_mask() after the check
for pmd_none() is bypassed, this ends up deferencing a NULL ptl or a
kernel oops.

Fix this by manually freeing all possible memory from the mm before
doing the munlock and then setting MMF_OOM_SKIP.  The oom reaper can not
run on the mm anymore so the munlock is safe to do in exit_mmap().  It
also matches the logic that the oom reaper currently uses for
determining when to set MMF_OOM_SKIP itself, so there's no new risk of
excessive oom killing.

This issue fixes CVE-2018-1000200.

Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1804241526320.238665@chino.kir.corp.google.com
Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurrently")
Signed-off-by: David Rientjes <rientjes@google.com>
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>	[4.14+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-05-11 17:28:45 -07:00
..
2018-02-14 09:43:22 -08:00
2017-11-14 16:49:31 -08:00
2017-11-28 16:30:38 +01:00
2018-02-01 09:51:57 -08:00
2018-01-01 22:54:42 -08:00
2018-04-13 16:20:36 -07:00
2018-02-20 11:34:54 +00:00
2018-03-08 13:56:24 +05:30
2018-03-29 14:29:55 -04:00
2018-04-07 12:08:19 -07:00
2018-04-10 12:09:27 -07:00
2018-04-12 12:55:50 -07:00
2018-04-20 17:18:35 -07:00
2018-04-11 10:28:37 -07:00
2018-04-25 21:13:40 -07:00
2018-03-16 10:56:13 +01:00
2018-03-31 02:15:18 +02:00
2018-03-31 02:16:26 +02:00
2018-02-04 11:16:35 -08:00
2017-11-15 18:21:04 -08:00
2018-03-16 15:45:51 -07:00
2018-01-03 14:03:48 +01:00
2018-03-16 10:55:47 +01:00
2018-03-26 15:09:38 +02:00
2017-11-13 21:05:31 -08:00
2017-11-27 16:19:56 -05:00
2018-04-05 10:23:24 -07:00
2018-04-05 14:21:13 -07:00
2018-03-12 10:05:01 +01:00
2018-01-01 12:40:27 -07:00
2018-03-26 15:56:44 +02:00
2018-03-31 02:15:18 +02:00
2017-11-13 01:41:20 +01:00
\n
2018-04-25 21:23:38 -07:00
2018-01-29 09:08:34 -08:00
2018-04-26 09:02:01 -06:00
2017-11-15 18:21:06 -08:00
2018-04-09 11:42:31 -07:00
2018-04-05 14:27:02 -07:00
2018-02-22 21:13:03 +01:00
2018-03-26 08:53:43 -06:00
2018-01-17 11:30:16 +00:00
2017-11-17 09:51:57 -08:00
2018-01-29 09:08:34 -08:00
2018-04-11 10:28:35 -07:00
2018-04-11 10:28:38 -07:00
2017-11-15 18:21:01 -08:00
2018-02-24 01:43:47 +01:00
2018-03-13 13:29:10 -07:00
2017-12-01 13:09:40 -08:00
2018-04-12 09:41:19 -07:00
2017-10-07 10:45:02 -06:00
2018-01-03 11:00:22 -05:00
2018-04-07 12:08:19 -07:00
2018-04-11 10:28:32 -07:00
2018-04-11 10:28:39 -07:00
2017-11-15 13:46:33 -08:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2018-03-30 12:56:22 -04:00
2017-11-17 14:18:00 -08:00
2017-11-17 16:10:00 -08:00
2018-01-28 22:17:24 -05:00
2017-11-15 15:01:28 -08:00
2018-01-08 08:22:45 -06:00
2018-02-01 10:57:45 -08:00
2018-01-17 15:25:50 +01:00
2018-01-08 08:22:45 -06:00
2018-04-11 10:28:39 -07:00
2018-01-31 17:18:37 -08:00
2017-11-09 10:23:28 +01:00
2018-04-06 18:31:06 -07:00
2018-04-06 18:31:06 -07:00
2018-01-19 16:50:53 -08:00
2017-11-17 16:10:04 -08:00
2017-11-17 16:10:04 -08:00
2017-11-13 01:33:48 +01:00
2017-12-16 02:05:48 +01:00
2018-02-20 16:12:26 -08:00
2017-12-11 14:37:11 -07:00
2018-03-17 14:20:55 +01:00
2018-03-01 08:33:05 -07:00
2017-11-07 12:22:21 +01:00
2018-04-05 14:27:02 -07:00
2018-01-29 12:02:54 -05:00
2018-04-05 21:36:24 -07:00
2018-04-05 21:36:27 -07:00
2018-01-18 11:56:49 +01:00
2018-01-15 12:07:46 -08:00
2018-02-06 09:59:40 -08:00
2018-02-06 18:32:47 -08:00
2018-01-09 16:27:43 +01:00
2018-04-10 11:27:30 -07:00
2018-02-20 16:10:25 -08:00
2017-10-11 22:36:54 -04:00
2018-02-06 18:32:44 -08:00
2017-12-20 09:53:54 -07:00
2017-10-04 10:29:22 +02:00