[Devel] [PATCH hci-8.1 1/7] oracle/mm: take a file reference when preserving a file-backed VMA

[Konstantin Khorenko]

A private mapping of /dev/zero is anonymous for vma_is_anonymous() but
keeps its vm_file, so MADV_DOEXEC accepts it. vma_dup() copies the
vm_file pointer without taking a reference, and both mms drop one at
teardown. Any user can do this with a binary that carries the
preserved-mem-ok note: map /dev/zero privately, close the fd, mark the
range and exec. The second fput() is a use-after-free of the struct
file.

Take the reference the way dup_mmap() does, and drop it if linking the
copy fails.

Fixes: 9e6d16a6c0a1 ("oracle/mm: introduce VM_EXEC_KEEP")
https://virtuozzo.atlassian.net/browse/VSTOR-150232

Feature: oracle/mm: MADV_DOEXEC madvise() flag
Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 mm/mmap.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mm/mmap.c b/mm/mmap.c
index bc508c6bd934b..52e971aee020f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1781,6 +1781,8 @@ int vma_dup(struct vm_area_struct *old_vma, struct mm_struct *mm)
 	ret = anon_vma_fork(vma, old_vma);
 	if (ret)
 		goto fail_nomem_anon_vma_fork;
+	if (vma->vm_file)
+		get_file(vma->vm_file);
 
 	/*
 	 * Clear functionality that should not carry over to the new
@@ -1814,6 +1816,8 @@ int vma_dup(struct vm_area_struct *old_vma, struct mm_struct *mm)
 	return ret;
 
 fail_nomem_vma_link:
+	if (vma->vm_file)
+		fput(vma->vm_file);
 	unlink_anon_vmas(vma);
 fail_nomem_anon_vma_fork:
 	mpol_put(vma_policy(vma));

-- 
2.43.0