[OLK-5.10] mm/slub: add missing TID updates on slab deactivation

#### 1. 问题描述

内存管理模块slub percpu变量TID 未及时更新导致内存泄漏或者uaf踩内存

#### 2. 涉及的模块

mm/slub

#### 3. 引入问题的补丁

| commit号      | 补丁标题                                                     | 主线版本 | 
| ------------- | ------------------------------------------------------------ | -------- | 
| c17dda40a6a4e | slub: Separate out kmem_cache_cpu processing from deactivate_slab | v3.6-rc1 |
| 03e404af26dc2 | slub: fast release on full slab                              | v3.1-rc1 |

#### 4. 修复问题的补丁

| 主线commit号 |  补丁标题                                              | 主线版本  | 
| ------------ | ----------------------------------------------------- | --------- | 
| eeaa345e1285 |  mm/slub: add missing TID updates on slab deactivation | v5.19-rc3 |   
| 6c32496964da |  mm/slub: add missing TID updates on slab deactivation | v5.10.130 |
| e2b2f0e2e34d |  mm/slub: add missing TID updates on slab deactivation | v4.19.252 |

#### 5. 根因分析

在do_slab_free()以及slab_alloc_node存在并发场景(抢占或者中断)，由于___slab_alloc()中未及时更新TID导致出现```c->page == NULL && c->freelist != NULL```的情况，之后可能导致内存泄漏或者UAF踩内存。

以openEuler-1.0-LTS版本为例：(针对同一个kmem_cache)

```c
TASK A: begin do_slab_free():
- tid = this_cpu_read(s->cpu_slab->tid);
- c = raw_cpu_ptr(s->cpu_slab);
- check `page == c->page` (true)
- read pcpu freelist (==NULL)
- [PREEMPT A->B]
- task B: begin slab_alloc_node():
  - fastpath fails (`c->freelist` is NULL)
  - enter __slab_alloc()
  - local_irq_save() (disables preemption)
  - enter ___slab_alloc()
  - read c->freelist as NULL
  - get_freelist() returns NULL
  - write `c->page = NULL`
  - goto new_slab
  - slub_percpu_partial() is NULL
  - enter new_slab_objects()
  - get_partial() returns NULL
  - enter new_slab()
  - enter allocate_slab()
  - if (gfpflags_allow_blocking(flags)) (GFP_KERNEL is ok)
     - local_irq_enable() (enables preemption)
- [PREEMPT B->A]
- task A: finish do_slab_free():
  - this_cpu_cmpxchg_double() succeeds() (only check freelist and tid)
  - [CORRUPT STATE: c->page==NULL, c->freelist!=NULL]
```

**内存泄漏情况：** TASK B接着运行

```c
TASK B: continue in new_slab_objects() (alloc page success)
 - freelist = page->freelist
 - c->page = page;
 - return to __slab_alloc()
 - goto load_freelist
 - c->freelist = get_freepointer(s, freelist) (clobbers TASK A set freelist cause memleak)
 - c->tid = next_tid(c->tid)
```

**UAF踩内存情况：** TASK A 申请另一个slab (CPU_PARTIAL_FREE 场景)

```c
- task A: run __slab_free() on object from other struct slab:
 - CPU_PARTIAL_FREE case (slab was on no list, is now on pcpu partial)
- task A: run slab_alloc_node() with NUMA node constraint:
 - fastpath fails (c->page is NULL)
 - call __slab_alloc()
 - local_irq_save() (disables preemption)
 - entet ___slab_alloc()
 - c->page is NULL: goto new_slab
 - slub_percpu_partial() is non-NULL
 - set c->page to slub_percpu_partial(c)
 - [CORRUPT STATE: c->slab points to slab-1, c->freelist has objects from slab-2]
 - goto redo
 - node_match() fails
 - enter deactivate_slab()
 - existing c->freelist is passed into deactivate_slab()
 - inuse count of slab-1 is decremented to account for object from slab-2  (cause slab-1 inuse lower, page will be free)
```
如果刚好有人申请到这个被踩的page，就会出现踩内存的问题。

#### 6. 问题触发场景

**在可抢占内核中概率较高，非抢占内核由于在```alloc_page_nodes()```中如果内存不足触发内存回收情况可能会睡眠，中断场景也有可能触发该情况。**

openEuler-1.0-LTS 上开启CONFIG_PREEMPT 打上如下故障注入补丁：

```
@@ -1602,7 +1603,10 @@ static struct page *allocate_slab(struct kmem_cache *s, gfp_>
 
        if (gfpflags_allow_blocking(flags))
                local_irq_enable();
+       
+       if (!in_atomic())
+               schedule();
+       
        flags |= s->allocflags;
 
        /*
@@ -2615,6 +2619,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpfla>
                goto redo;
        }
 
        freelist = new_slab_objects(s, gfpflags, node, &c);
 
        if (unlikely(!freelist)) {
@@ -2682,6 +2687,7 @@ static __always_inline void *slab_alloc_node(struct kmem_cach>
        if (!s)
                return NULL;
 redo:
        /*
         * Must read kmem_cache cpu data via this cpu ptr. Preemption is
         * enabled. We may switch back and forth between cpus while
@@ -2717,6 +2723,7 @@ static __always_inline void *slab_alloc_node(struct kmem_cach>
 
        object = c->freelist;
        page = c->page;

if (unlikely(!object || !node_match(page, node))) {
                object = __slab_alloc(s, gfpflags, node, addr, c);
                stat(s, ALLOC_SLOWPATH);
@@ -2976,9 +2983,13 @@ static __always_inline void do_slab_free(struct kmem_cache *>
 
        if (likely(page == c->page)) {
                void **freelist = READ_ONCE(c->freelist);
+               unsigned long flags;
 
                set_freepointer(s, tail_obj, freelist);
 
+               if (!in_atomic())
+                       schedule();
+
                if (unlikely(!this_cpu_cmpxchg_double(
                                s->cpu_slab->freelist, s->cpu_slab->tid,
                                freelist, tid,
@@ -2987,6 +2998,9 @@ static __always_inline void do_slab_free(struct kmem_cache *s,
                        note_cmpxchg_failure("slab_free", s, tid);
                        goto redo;
                }
+               local_irq_save(flags);
+               WARN_ON(!READ_ONCE(c->page) && READ_ONCE(c->freelist));
+               local_irq_restore(flags);
                stat(s, FREE_FASTPATH);
        } else
                __slab_free(s, page, head, tail_obj, cnt, addr);
```

虚拟机配置为(12CPU, 24G内存)：

poc代码(unstable)：

```c
#include <stdio.h>
#include <pthread.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>

#define MAX_NUMS 4096
#define FILE_LEN 32
#define MAX_THREADS 32

void *tst_thread(void *arg)
{
        int i;
        int fd[MAX_NUMS];

while(1) {
                for (i = 0; i < MAX_NUMS; i++) {
                        char name[FILE_LEN];
                        sprintf(name, "./test%d-%d", *(int *)arg, i);
                        fd[i] = open(name, O_CREAT | O_RDWR);
                        if (fd[i] < 0)
                                continue;
                        if (i % 5 == 0)
                                usleep(10);

write(fd[i], "dddd", 0);
                        close(fd[i]);
                }
        }
}

int main()
{
        int i;
        pthread_t t;

for (i = 0; i < MAX_THREADS; i++) {
                pthread_create(&t, NULL, tst_thread, &i);
        }

while (1) {
                sleep(1);
        }
        return 0;
}
```

同时进行syzkaller测试：

```
./syz-execprog -executor=./syz-executor -repeat=0 -procs=14 -cover=0 log
```
这里的syz log非特殊log，使用任意syzlog应该也可行。
大概半小时之后可以触发如下告警日志：
```
syzkaller login: [  119.561701] ------------[ cut here ]------------
[  119.561701] ------------[ cut here ]------------
[  119.563119] WARNING: CPU: 5 PID: 526 at mm/slub.c:3002 kmem_cache_free+0x150/0x308
[  119.563119] WARNING: CPU: 5 PID: 526 at mm/slub.c:3002 kmem_cache_free+0x150/0x308
[  119.565077] Modules linked in:
[  119.565077] Modules linked in:
[  119.565875] CPU: 5 PID: 526 Comm: syz-executor Tainted: G        W         4.19.90+ #106
[  119.565875] CPU: 5 PID: 526 Comm: syz-executor Tainted: G        W         4.19.90+ #106
[  119.567974] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[  119.567974] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[  119.569756] pstate: 40400085 (nZcv daIf +PAN -UAO)
[  119.569756] pstate: 40400085 (nZcv daIf +PAN -UAO)
[  119.571007] pc : kmem_cache_free+0x150/0x308
[  119.571007] pc : kmem_cache_free+0x150/0x308
[  119.572129] lr : kmem_cache_free+0x150/0x308
[  119.572129] lr : kmem_cache_free+0x150/0x308
[  119.573233] sp : ffff0000254cfcc0
[  119.573233] sp : ffff0000254cfcc0
[  119.574089] x29: ffff0000254cfcc0 x28: ffff8000c4aa9d80 
[  119.574089] x29: ffff0000254cfcc0 x28: ffff8000c4aa9d80 
[  119.575479] x27: 0000000000000000 x26: 0000000000000000 
[  119.575479] x27: 0000000000000000 x26: 0000000000000000 
[  119.576866] x25: ffff8000c001ae00 x24: ffff8003fff82480 
[  119.576866] x25: ffff8000c001ae00 x24: ffff8003fff82480 
[  119.578242] x23: 0000000000000000 x22: 0000000000000000 
[  119.578242] x23: 0000000000000000 x22: 0000000000000000 
[  119.579638] x21: ffff000008394b80 x20: ffff800100676540 
[  119.579638] x21: ffff000008394b80 x20: ffff800100676540 
[  119.581013] x19: 0000000000000000 x18: ffffffffffffffff 
[  119.581013] x19: 0000000000000000 x18: ffffffffffffffff 
[  119.582382] x17: 0000000000000000 x16: 0000000000000000 
[  119.582382] x17: 0000000000000000 x16: 0000000000000000 
[  119.583753] x15: ffff000008ed6260 x14: ffff0000895eb237 
[  119.583753] x15: ffff000008ed6260 x14: ffff0000895eb237 
[  119.585146] x13: ffff0000095eb245 x12: ffff0000093ded70 
[  119.585146] x13: ffff0000095eb245 x12: ffff0000093ded70 
[  119.586526] x11: 0000000005f5e0ff x10: ffff0000254cf9a0 
[  119.586526] x11: 0000000005f5e0ff x10: ffff0000254cf9a0 
[  119.587919] x9 : 00000000ffffffd0 x8 : 5d20657265682074 
[  119.587919] x9 : 00000000ffffffd0 x8 : 5d20657265682074 
[  119.589311] x7 : 7563205b2d2d2d2d x6 : ffff8003fff62450 
[  119.589311] x7 : 7563205b2d2d2d2d x6 : ffff8003fff62450 
[  119.590685] x5 : ffff8003fff62450 x4 : 00008003f6ef0000 
[  119.590685] x5 : ffff8003fff62450 x4 : 00008003f6ef0000 
[  119.592084] x3 : 0000000000000002 x2 : 2109c8ec81ebf500 
[  119.592084] x3 : 0000000000000002 x2 : 2109c8ec81ebf500 
[  119.593468] x1 : 0000000000000000 x0 : 0000000000000024 
[  119.593468] x1 : 0000000000000000 x0 : 0000000000000024 
[  119.594850] Call trace:
[  119.594850] Call trace:
[  119.595552]  kmem_cache_free+0x150/0x308
[  119.595552]  kmem_cache_free+0x150/0x308
[  119.596571]  dentry_free+0x70/0xe0
[  119.596571]  dentry_free+0x70/0xe0
[  119.597455]  __dentry_kill+0x168/0x208
[  119.597455]  __dentry_kill+0x168/0x208
[  119.598417]  dentry_kill+0x54/0x250
[  119.598417]  dentry_kill+0x54/0x250
[  119.599324]  dput+0x1b0/0x220
[  119.599324]  dput+0x1b0/0x220
[  119.600103]  __fput+0xcc/0x1d0
[  119.600103]  __fput+0xcc/0x1d0
[  119.600907]  ____fput+0x20/0x30
[  119.600907]  ____fput+0x20/0x30
[  119.601720]  task_work_run+0x80/0xe0
[  119.601720]  task_work_run+0x80/0xe0
[  119.602639]  do_notify_resume+0x134/0x360
[  119.602639]  do_notify_resume+0x134/0x360
[  119.603665]  work_pending+0x8/0x10
[  119.603665]  work_pending+0x8/0x10
[  119.604554] ---[ end trace e1229a390b481ae1 ]---
```

打上如下修复补丁则24小时未复现：

```
diff --git a/mm/slub.c b/mm/slub.c
index 7b5630ca9274..4bc29bcd0d5d 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2168,6 +2168,7 @@  static void deactivate_slab(struct kmem_cache *s, struct page *page,
 
 	c->page = NULL;
 	c->freelist = NULL;
+	c->tid = next_tid(c->tid);
 }
 
 /*
@@ -2301,8 +2302,6 @@  static inline void flush_slab(struct kmem_cache *s, struct kmem_cache_cpu *c)
 {
 	stat(s, CPUSLAB_FLUSH);
 	deactivate_slab(s, c->page, c->freelist, c);
-
-	c->tid = next_tid(c->tid);
 }
 
 /*
@@ -2589,6 +2588,7 @@  static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node,
 
 	if (!freelist) {
 		c->page = NULL;
+		c->tid = next_tid(c->tid);
 		stat(s, DEACTIVATE_BYPASS);
 		goto new_slab;
 	}
```

#### 7. 确认方法

CONFIG_SLUB=y则涉及(默认打开)。

CONFIG_PREEMPT=y 出现概率较高。

#### 8. 影响和风险

内存泄漏或者uaf踩内存。

#### 9. 规避手段

无。

#### 10. 解决方案

合入修复补丁。

GVP openEuler/kernel

Content Risk Flag

Comments (1)

GVPopenEuler/kernel

Content Risk Flag