No description
Find a file
David Hildenbrand 6564b014af mm/secretmem: fix GUP-fast succeeding on secretmem folios
commit 65291dcfcf upstream.

folio_is_secretmem() currently relies on secretmem folios being LRU
folios, to save some cycles.

However, folios might reside in a folio batch without the LRU flag set, or
temporarily have their LRU flag cleared.  Consequently, the LRU flag is
unreliable for this purpose.

In particular, this is the case when secretmem_fault() allocates a fresh
page and calls filemap_add_folio()->folio_add_lru().  The folio might be
added to the per-cpu folio batch and won't get the LRU flag set until the
batch was drained using e.g., lru_add_drain().

Consequently, folio_is_secretmem() might not detect secretmem folios and
GUP-fast can succeed in grabbing a secretmem folio, crashing the kernel
when we would later try reading/writing to the folio, because the folio
has been unmapped from the directmap.

Fix it by removing that unreliable check.

Link: https://lkml.kernel.org/r/20240326143210.291116-2-david@redhat.com
Fixes: 1507f51255 ("mm: introduce memfd_secret system call to create "secret" memory areas")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: xingwei lee <xrivendell7@gmail.com>
Reported-by: yue sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/lkml/CABOYnLyevJeravW=QrH0JUPYEcDN160aZFb7kwndm-J2rmz0HQ@mail.gmail.com/
Debugged-by: Miklos Szeredi <miklos@szeredi.hu>
Tested-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Mike Rapoport (IBM) <rppt@kernel.org>
Cc: Lorenzo Stoakes <lstoakes@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-04-10 16:19:43 +02:00
arch x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO 2024-04-10 16:19:43 +02:00
block block: Clear zone limits for a non-zoned stacked queue 2024-04-10 16:18:35 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-22 14:22:01 +02:00
crypto exit: Rename module_put_and_exit to module_put_and_kthread_exit 2024-04-10 16:18:55 +02:00
Documentation x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled 2024-04-10 16:19:34 +02:00
drivers of: dynamic: Synchronize of_changeset_destroy() with the devlink removals 2024-04-10 16:19:42 +02:00
fs fs/pipe: Fix lockdep false-positive in watchqueue pipe_write() 2024-04-10 16:19:42 +02:00
include mm/secretmem: fix GUP-fast succeeding on secretmem folios 2024-04-10 16:19:43 +02:00
init init: open /initrd.image with O_LARGEFILE 2024-04-10 16:19:31 +02:00
io_uring io_uring: ensure '0' is returned on file registration success 2024-04-10 16:19:37 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:28:45 +01:00
kernel locking/rwsem: Disable preemption while trying for rwsem lock 2024-04-10 16:19:37 +02:00
lib arch: Introduce CONFIG_FUNCTION_ALIGNMENT 2024-04-10 16:18:49 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations 2024-04-10 16:19:37 +02:00
net mptcp: don't account accept() of non-MPC client as fallback to TCP 2024-04-10 16:19:43 +02:00
samples samples/hw_breakpoint: fix building without module unloading 2023-09-23 11:10:01 +02:00
scripts kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 2024-04-10 16:18:41 +02:00
security landlock: Warn once if a Landlock action is requested while disabled 2024-04-10 16:18:39 +02:00
sound ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone 2024-04-10 16:19:42 +02:00
tools mptcp: don't account accept() of non-MPC client as fallback to TCP 2024-04-10 16:19:43 +02:00
usr usr/include/Makefile: add linux/nfc.h to the compile-test coverage 2022-02-01 17:27:15 +01:00
virt KVM: Always flush async #PF workqueue when vCPU is being destroyed 2024-04-10 16:18:34 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore .gitignore: ignore only top-level modules.builtin 2021-05-02 00:43:35 +09:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS trace: Relocate event helper files 2024-04-10 16:19:24 +02:00
Makefile arch: Introduce CONFIG_FUNCTION_ALIGNMENT 2024-04-10 16:18:49 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.