[Devel] [PATCH RHEL7 COMMIT] mm, mempolicy: task->mempolicy must be NULL before dropping final reference

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-693.1.1.vz7.37.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-693.1.1.vz7.37.4
------>
commit 3e990c7b0ba7321ee04ddc7dbece6edc3afea0b0
Author: David Rientjes <rientjes at google.com>
Date:   Fri Sep 15 17:27:30 2017 +0300

    mm, mempolicy: task->mempolicy must be NULL before dropping final reference
    
    KASAN allocates memory from the page allocator as part of
    kmem_cache_free(), and that can reference current->mempolicy through any
    number of allocation functions.  It needs to be NULL'd out before the
    final reference is dropped to prevent a use-after-free bug:
    
    	BUG: KASAN: use-after-free in alloc_pages_current+0x363/0x370 at addr ffff88010b48102c
    	CPU: 0 PID: 15425 Comm: trinity-c2 Not tainted 4.8.0-rc2+ #140
    	...
    	Call Trace:
    		dump_stack
    		kasan_object_err
    		kasan_report_error
    		__asan_report_load2_noabort
    		alloc_pages_current	<-- use after free
    		depot_save_stack
    		save_stack
    		kasan_slab_free
    		kmem_cache_free
    		__mpol_put		<-- free
    		do_exit
    
    This patch sets current->mempolicy to NULL before dropping the final
    reference.
    
    Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1608301442180.63329@chino.kir.corp.google.com
    Fixes: cd11016e5f52 ("mm, kasan: stackdepot implementation. Enable stackdepot for SLAB")
    Signed-off-by: David Rientjes <rientjes at google.com>
    Reported-by: Vegard Nossum <vegard.nossum at oracle.com>
    Acked-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
    Cc: Alexander Potapenko <glider at google.com>
    Cc: Dmitry Vyukov <dvyukov at google.com>
    Cc: <stable at vger.kernel.org>	[4.6+]
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    https://jira.sw.ru/browse/PSBM-69081
    (cherry picked from commit c11600e4fed67ae4cd6a8096936afd445410e8ed)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 include/linux/mempolicy.h |  4 ++++
 kernel/exit.c             |  7 +------
 mm/mempolicy.c            | 17 +++++++++++++++++
 3 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 7f26526..7e47465 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -196,6 +196,7 @@ static inline int vma_migratable(struct vm_area_struct *vma)
 }
 
 extern int mpol_misplaced(struct page *, struct vm_area_struct *, unsigned long);
+extern void mpol_put_task_policy(struct task_struct *);
 
 #else
 
@@ -320,5 +321,8 @@ static inline int mpol_misplaced(struct page *page, struct vm_area_struct *vma,
 	return -1; /* no node preference */
 }
 
+static inline void mpol_put_task_policy(struct task_struct *task)
+{
+}
 #endif /* CONFIG_NUMA */
 #endif
diff --git a/kernel/exit.c b/kernel/exit.c
index 668cacf..32b7ba2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -866,12 +866,7 @@ void do_exit(long code)
 	ptrace_put_breakpoints(tsk);
 
 	exit_notify(tsk, group_dead);
-#ifdef CONFIG_NUMA
-	task_lock(tsk);
-	mpol_put(tsk->mempolicy);
-	tsk->mempolicy = NULL;
-	task_unlock(tsk);
-#endif
+	mpol_put_task_policy(tsk);
 #ifdef CONFIG_FUTEX
 	if (unlikely(current->pi_state_cache))
 		kfree(current->pi_state_cache);
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 9b78006..a2e2422 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2377,6 +2377,23 @@ int mpol_misplaced(struct page *page, struct vm_area_struct *vma, unsigned long
 	return ret;
 }
 
+/*
+ * Drop the (possibly final) reference to task->mempolicy.  It needs to be
+ * dropped after task->mempolicy is set to NULL so that any allocation done as
+ * part of its kmem_cache_free(), such as by KASAN, doesn't reference a freed
+ * policy.
+ */
+void mpol_put_task_policy(struct task_struct *task)
+{
+	struct mempolicy *pol;
+
+	task_lock(task);
+	pol = task->mempolicy;
+	task->mempolicy = NULL;
+	task_unlock(task);
+	mpol_put(pol);
+}
+
 static void sp_delete(struct shared_policy *sp, struct sp_node *n)
 {
 	pr_debug("deleting %lx-l%lx\n", n->start, n->end);