From owner-svn-src-head@freebsd.org Fri May 5 14:09:45 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7EEB5D5E43E; Fri, 5 May 2017 14:09:45 +0000 (UTC) (envelope-from hselasky@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 43B6967D; Fri, 5 May 2017 14:09:45 +0000 (UTC) (envelope-from hselasky@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v45E9il0084111; Fri, 5 May 2017 14:09:44 GMT (envelope-from hselasky@FreeBSD.org) Received: (from hselasky@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v45E9i2w084110; Fri, 5 May 2017 14:09:44 GMT (envelope-from hselasky@FreeBSD.org) Message-Id: <201705051409.v45E9i2w084110@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: hselasky set sender to hselasky@FreeBSD.org using -f From: Hans Petter Selasky Date: Fri, 5 May 2017 14:09:44 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r317828 - head/sys/compat/linuxkpi/common/src X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 May 2017 14:09:45 -0000 Author: hselasky Date: Fri May 5 14:09:44 2017 New Revision: 317828 URL: https://svnweb.freebsd.org/changeset/base/317828 Log: Fix for use after free in the LinuxKPI. Background: The same VM object might be shared by multiple processes and the mm_struct is usually freed when a process exits. Grab a reference on the mm_struct while the vmap is in the linux_vma_head list in case the first process which inserted a VM object has exited. Tested by: kwm @ MFC after: 1 week Sponsored by: Mellanox Technologies Modified: head/sys/compat/linuxkpi/common/src/linux_compat.c Modified: head/sys/compat/linuxkpi/common/src/linux_compat.c ============================================================================== --- head/sys/compat/linuxkpi/common/src/linux_compat.c Fri May 5 13:31:25 2017 (r317827) +++ head/sys/compat/linuxkpi/common/src/linux_compat.c Fri May 5 14:09:44 2017 (r317828) @@ -485,6 +485,16 @@ linux_cdev_handle_insert(void *handle, s return (NULL); } } + /* + * The same VM object might be shared by multiple processes + * and the mm_struct is usually freed when a process exits. + * + * The atomic reference below makes sure the mm_struct is + * available as long as the vmap is in the linux_vma_head. + */ + if (atomic_inc_not_zero(&vmap->vm_mm->mm_users) == 0) + panic("linuxkpi: mm_users is zero\n"); + TAILQ_INSERT_TAIL(&linux_vma_head, vmap, vm_entry); rw_wunlock(&linux_vma_lock); return (vmap); @@ -499,6 +509,9 @@ linux_cdev_handle_remove(struct vm_area_ rw_wlock(&linux_vma_lock); TAILQ_REMOVE(&linux_vma_head, vmap, vm_entry); rw_wunlock(&linux_vma_lock); + + /* Drop reference on mm_struct */ + mmput(vmap->vm_mm); kfree(vmap); }