Files
linux/include/linux
David Rientjes 2270dfcc4b mm, oom: fix concurrent munlock and oom reaper unmap, v3
commit 27ae357fa8 upstream.

Since exit_mmap() is done without the protection of mm->mmap_sem, it is
possible for the oom reaper to concurrently operate on an mm until
MMF_OOM_SKIP is set.

This allows munlock_vma_pages_all() to concurrently run while the oom
reaper is operating on a vma.  Since munlock_vma_pages_range() depends
on clearing VM_LOCKED from vm_flags before actually doing the munlock to
determine if any other vmas are locking the same memory, the check for
VM_LOCKED in the oom reaper is racy.

This is especially noticeable on architectures such as powerpc where
clearing a huge pmd requires serialize_against_pte_lookup().  If the pmd
is zapped by the oom reaper during follow_page_mask() after the check
for pmd_none() is bypassed, this ends up deferencing a NULL ptl or a
kernel oops.

Fix this by manually freeing all possible memory from the mm before
doing the munlock and then setting MMF_OOM_SKIP.  The oom reaper can not
run on the mm anymore so the munlock is safe to do in exit_mmap().  It
also matches the logic that the oom reaper currently uses for
determining when to set MMF_OOM_SKIP itself, so there's no new risk of
excessive oom killing.

This issue fixes CVE-2018-1000200.

Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1804241526320.238665@chino.kir.corp.google.com
Fixes: 2129258024 ("mm: oom: let oom_reap_task and exit_mmap run concurrently")
Signed-off-by: David Rientjes <rientjes@google.com>
Suggested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>	[4.14+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-16 10:10:27 +02:00
..
2018-04-24 09:36:39 +02:00
2017-06-08 18:52:36 -07:00
2017-12-29 17:53:47 +01:00
2017-12-25 14:26:33 +01:00
2017-07-03 16:56:28 -06:00
2018-02-22 15:42:23 +01:00
2017-08-30 14:40:40 +02:00
2018-01-17 09:45:27 +01:00
2017-08-24 13:23:03 -07:00
2018-02-22 15:42:23 +01:00
2017-07-17 13:42:48 +02:00
2017-08-03 19:09:26 -07:00
2017-08-07 17:22:14 +02:00
2018-02-22 15:42:23 +01:00
2017-05-18 10:07:40 -04:00
2017-06-21 14:37:12 -04:00
2018-02-22 15:42:24 +01:00
2017-08-15 18:23:52 +02:00
2017-08-14 13:33:39 -07:00
2017-08-28 20:51:22 +02:00
2017-09-07 11:53:11 +02:00
2018-02-22 15:42:23 +01:00
2018-02-22 15:42:23 +01:00
2017-07-06 11:30:07 -04:00
2017-07-25 18:05:25 +02:00
2017-09-25 08:56:05 -06:00
2017-05-26 10:10:37 +02:00
2017-08-06 20:55:29 -07:00
2018-02-22 15:42:23 +01:00
2017-07-06 16:24:30 -07:00
2017-08-16 16:28:47 -07:00
2018-02-22 15:42:23 +01:00
2017-07-24 17:50:37 +02:00
2017-08-31 18:50:14 +02:00
2017-08-15 09:02:07 -07:00
2017-08-15 09:02:08 -07:00