Re: [PATCH] mm/ksm: avoid anon_vma UAF during page merging

[Zhao Gongyi]

Hi Xu,

Thanks for the review.

On 11/2/26 6:18 PM, xu.xin@xxxxxxxxx wrote:
> 
> I’d like to ask whether this issue is easy to reproduce on 6.18 since
> I suspect the accuracy of the “fixes” tag in the commit description.
> 
> Besides, adding an extra folio_test_ksm() check is unneeded, see reasons below.
> 

I reproduced the issue twice on v6.18
(7d0a66e4bb90, CONFIG_KSM=y, CONFIG_KASAN=y and
CONFIG_KASAN_GENERIC=y).

The exact invocation from my previous email:

   /tmp/ksm_fixed_pool_static 4 2048 1 100000 64

reproduced the issue after about 220 seconds:

   BUG: KASAN: slab-use-after-free in page_address_in_vma+0x292/0x2b0
   Read of size 8 by task ksmd

   page_address_in_vma
   write_protect_page
   try_to_merge_one_page
   try_to_merge_with_ksm_page
   ksm_scan_thread

The corresponding free path included:

   __put_anon_vma
   unlink_anon_vmas
   ...
   mremap_to
   do_mremap

A second run with 4096 slots reproduced the same UAF after about
142 seconds. This confirms that the issue is present in v6.18.

I also rechecked the Fixes tag. Before 21d0d443cdc1
("rmap: resurrect page_address_in_vma anon_vma check"), the anonymous
page path in page_address_in_vma() computed the address without
dereferencing the page-side anon_vma. That commit added the comparison
between vma->anon_vma->root and page_anon_vma(page)->root.

At that time, the KSM scan path already retained a page reference,
dropped mmap_sem, and later called page_address_in_vma() from
write_protect_page() or replace_page(). The page reference does not
pin the page-side anon_vma.

Commit 4829b906cc06 ("ksm: fix page_address_in_vma anon_vma oops")
added a NULL check, but the helper still dereferences the anon_vma
when it is non-NULL but stale.

MREMAP_DONTUNMAP, especially commit 1583aa278f5f
("mm: mremap: unlink anon_vmas when mremap with MREMAP_DONTUNMAP
success"), makes this race easy to reproduce and explains the
unlink_anon_vmas() free path. However, it did not introduce the
unpinned anon_vma dereference that this patch removes. Based on that,
I think 21d0d443cdc1 remains the earliest appropriate Fixes commit.
Please let me know if I am missing a lifetime guarantee that made the
dereference safe before the MREMAP_DONTUNMAP changes.

You are also right that the folio_test_ksm() check is unnecessary.
cmp_and_merge_page() already checks folio_stable_node(), and a KSM
fork page that continues through this path is handled by the
page == kpage check in try_to_merge_one_page(). I will drop that hunk
and the corresponding commit-message text in v2.

Thanks,
Gongyi