mm/mempolicy: CVE-2018-10675

mm/mempolicy: fix use after free when calling get_mempolicy

References:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=fd30faeaf0f5163356ec053ba9eb1d3b7923062c

Change-Id: I7eca8926a82fe573447c8742be055b3f2c5df6e5
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

2 files changed, 94 insertions, 0 deletions

diff --git a/patches/cve/4.1.x.scc b/patches/cve/4.1.x.scc
index 6386a9b..475bc09 100644
--- a/patches/cve/4.1.x.scc
+++ b/patches/cve/4.1.x.scc
@@ -22,3 +22,6 @@ patch CVE-2017-18017-netfilter-xt_TCPMSS-add-more-sanity-tests-on-tcph-do.patch
 #fixed in 4.1.44
 patch CVE-2017-1000111-packet-fix-tp_reserve-race-in-packet_set_ring.patch
 
+#fixed in 4.1.45
+patch CVE-2018-10675-mm-mempolicy-fix-use-after-free-when-calling-get_mem.patch
+
diff --git a/patches/cve/CVE-2018-10675-mm-mempolicy-fix-use-after-free-when-calling-get_mem.patch b/patches/cve/CVE-2018-10675-mm-mempolicy-fix-use-after-free-when-calling-get_mem.patch
new file mode 100644
index 0000000..47e6e78
--- /dev/null
+++ b/patches/cve/CVE-2018-10675-mm-mempolicy-fix-use-after-free-when-calling-get_mem.patch
@@ -0,0 +1,91 @@
+From fd30faeaf0f5163356ec053ba9eb1d3b7923062c Mon Sep 17 00:00:00 2001
+From: zhong jiang <zhongjiang@huawei.com>
+Date: Fri, 18 Aug 2017 15:16:24 -0700
+Subject: [PATCH] mm/mempolicy: fix use after free when calling get_mempolicy
+
+[ Upstream commit 73223e4e2e3867ebf033a5a8eb2e5df0158ccc99 ]
+
+I hit a use after free issue when executing trinity and repoduced it
+with KASAN enabled.  The related call trace is as follows.
+
+  BUG: KASan: use after free in SyS_get_mempolicy+0x3c8/0x960 at addr ffff8801f582d766
+  Read of size 2 by task syz-executor1/798
+
+  INFO: Allocated in mpol_new.part.2+0x74/0x160 age=3 cpu=1 pid=799
+     __slab_alloc+0x768/0x970
+     kmem_cache_alloc+0x2e7/0x450
+     mpol_new.part.2+0x74/0x160
+     mpol_new+0x66/0x80
+     SyS_mbind+0x267/0x9f0
+     system_call_fastpath+0x16/0x1b
+  INFO: Freed in __mpol_put+0x2b/0x40 age=4 cpu=1 pid=799
+     __slab_free+0x495/0x8e0
+     kmem_cache_free+0x2f3/0x4c0
+     __mpol_put+0x2b/0x40
+     SyS_mbind+0x383/0x9f0
+     system_call_fastpath+0x16/0x1b
+  INFO: Slab 0xffffea0009cb8dc0 objects=23 used=8 fp=0xffff8801f582de40 flags=0x200000000004080
+  INFO: Object 0xffff8801f582d760 @offset=5984 fp=0xffff8801f582d600
+
+  Bytes b4 ffff8801f582d750: ae 01 ff ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a  ........ZZZZZZZZ
+  Object ffff8801f582d760: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
+  Object ffff8801f582d770: 6b 6b 6b 6b 6b 6b 6b a5                          kkkkkkk.
+  Redzone ffff8801f582d778: bb bb bb bb bb bb bb bb                          ........
+  Padding ffff8801f582d8b8: 5a 5a 5a 5a 5a 5a 5a 5a                          ZZZZZZZZ
+  Memory state around the buggy address:
+  ffff8801f582d600: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
+  ffff8801f582d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+  >ffff8801f582d700: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fc
+
+!shared memory policy is not protected against parallel removal by other
+thread which is normally protected by the mmap_sem.  do_get_mempolicy,
+however, drops the lock midway while we can still access it later.
+
+Early premature up_read is a historical artifact from times when
+put_user was called in this path see https://lwn.net/Articles/124754/
+but that is gone since 8bccd85ffbaf ("[PATCH] Implement sys_* do_*
+layering in the memory policy layer.").  but when we have the the
+current mempolicy ref count model.  The issue was introduced
+accordingly.
+
+Fix the issue by removing the premature release.
+
+Link: http://lkml.kernel.org/r/1502950924-27521-1-git-send-email-zhongjiang@huawei.com
+
+CVE: CVE-2018-10675 
+Upstream-Status: Backport  
+
+Signed-off-by: zhong jiang <zhongjiang@huawei.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Mel Gorman <mgorman@techsingularity.net>
+Cc: <stable@vger.kernel.org>    [2.6+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ mm/mempolicy.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index ea06282..dacd2e9 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -897,11 +897,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
+                *policy |= (pol->flags & MPOL_MODE_FLAGS);
+        }
+ 
+-       if (vma) {
+-               up_read(&current->mm->mmap_sem);
+-               vma = NULL;
+-       }
+-
+        err = 0;
+        if (nmask) {
+                if (mpol_store_user_nodemask(pol)) {
+-- 
+2.7.4
+