2022-10-19 03:56:06

by Zheng Wang

Subject: [PATCH v4] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os

Gts may be freed in gru_check_chiplet_assignment.
The caller still use it after that, UAF happens.

Fix it by introducing a return value to see if it's in error path or not.
Free the gts in caller if gru_check_chiplet_assignment check failed.

Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2")
Reported-by: Zheng Wang <[email protected]>
Signed-off-by: Zheng Wang <[email protected]>
---
v4:
- use VM_FAULT_NOPAGE as failure code in gru_fault and -EINVAL in other functions suggested by Yejian

v3:
- add preempt_enable and use VM_FAULT_NOPAGE as failure code suggested by Yejian

v2:
- commit message changes suggested by Greg

v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/
---
drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++--
drivers/misc/sgi-gru/grumain.c | 18 ++++++++++++++----
drivers/misc/sgi-gru/grutables.h | 2 +-
3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index d7ef61e602ed..2b5b049fbd38 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb)
if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
goto exit;

- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
+ if (ret)
+ goto err;

/*
* CCH may contain stale data if ts_force_cch_reload is set.
@@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb)
exit:
gru_unlock_gts(gts);
return ret;
+err:
+ gru_unlock_gts(gts);
+ gru_unload_context(gts, 1);
+ return -EINVAL;
}

/*
@@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg)
} else {
gts->ts_user_blade_id = req.val1;
gts->ts_user_chiplet_id = req.val0;
- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
}
break;
case sco_gseg_owner:
@@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg)
ret = -EINVAL;
}
gru_unlock_gts(gts);
+ if (ret) {
+ gru_unload_context(gts, 1);
+ ret = -EINVAL;
+ }

return ret;
}
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 9afda47efbf2..77becb52f550 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
* chiplet. Misassignment can occur if the process migrates to a different
* blade or if the user changes the selected blade/chiplet.
*/
-void gru_check_context_placement(struct gru_thread_state *gts)
+int gru_check_context_placement(struct gru_thread_state *gts)
{
struct gru_state *gru;
+ int ret = 0;

/*
* If the current task is the context owner, verify that the
@@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts)
*/
gru = gts->ts_gru;
if (!gru || gts->ts_tgid_owner != current->tgid)
- return;
+ return ret;

if (!gru_check_chiplet_assignment(gru, gts)) {
STAT(check_context_unload);
- gru_unload_context(gts, 1);
+ ret = -EINVAL;
} else if (gru_retarget_intr(gts)) {
STAT(check_context_retarget_intr);
}
+
+ return ret;
}


@@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
struct gru_thread_state *gts;
unsigned long paddr, vaddr;
unsigned long expires;
+ int ret;

vaddr = vmf->address;
gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -934,7 +938,13 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
mutex_lock(&gts->ts_ctxlock);
preempt_disable();

- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
+ if (ret) {
+ preempt_enable();
+ mutex_unlock(&gts->ts_ctxlock);
+ gru_unload_context(gts, 1);
+ return VM_FAULT_NOPAGE;
+ }

if (!gts->ts_gru) {
STAT(load_user_context);
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 5efc869fe59a..f4a5a787685f 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
extern int gru_user_unload_context(unsigned long arg);
extern int gru_get_exception_detail(unsigned long arg);
extern int gru_set_context_option(unsigned long address);
-extern void gru_check_context_placement(struct gru_thread_state *gts);
+extern int gru_check_context_placement(struct gru_thread_state *gts);
extern int gru_cpu_fault_map_id(void);
extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
extern void gru_flush_all_tlb(struct gru_state *gru);
--
2.25.1

2022-10-19 14:59:19

by Dimitri Sivanich

Subject: Re: [PATCH v4] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os

On Wed, Oct 19, 2022 at 11:14:45AM +0800, Zheng Wang wrote:
> Gts may be freed in gru_check_chiplet_assignment.
> The caller still use it after that, UAF happens.
>
> Fix it by introducing a return value to see if it's in error path or not.
> Free the gts in caller if gru_check_chiplet_assignment check failed.
>
> Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2")
> Reported-by: Zheng Wang <[email protected]>
> Signed-off-by: Zheng Wang <[email protected]>
> ---
> v4:
> - use VM_FAULT_NOPAGE as failure code in gru_fault and -EINVAL in other functions suggested by Yejian
>
> v3:
> - add preempt_enable and use VM_FAULT_NOPAGE as failure code suggested by Yejian
>
> v2:
> - commit message changes suggested by Greg
>
> v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/
> ---
> drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++--
> drivers/misc/sgi-gru/grumain.c | 18 ++++++++++++++----
> drivers/misc/sgi-gru/grutables.h | 2 +-
> 3 files changed, 27 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
> index d7ef61e602ed..2b5b049fbd38 100644
> --- a/drivers/misc/sgi-gru/grufault.c
> +++ b/drivers/misc/sgi-gru/grufault.c
> @@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb)
> if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
> goto exit;
>
> - gru_check_context_placement(gts);
> + ret = gru_check_context_placement(gts);
> + if (ret)
> + goto err;
>
> /*
> * CCH may contain stale data if ts_force_cch_reload is set.
> @@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb)
> exit:
> gru_unlock_gts(gts);
> return ret;
> +err:
> + gru_unlock_gts(gts);
> + gru_unload_context(gts, 1);
> + return -EINVAL;
> }
>
> /*
> @@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg)
> } else {
> gts->ts_user_blade_id = req.val1;
> gts->ts_user_chiplet_id = req.val0;
> - gru_check_context_placement(gts);
> + ret = gru_check_context_placement(gts);

In gru_set_context_option(), you are calling gru_unload_context() for all
non-zero 'ret' values, but there are other instances where non-zero 'ret'
values are being set that should not call gru_unload_context(). Maybe do
this instead:
if (gru_check_context_placement(gts)) {
gru_unlock_gts(gts);
gru_unload_context(gts, 1);
return -EINVAL;
}

> }
> break;
> case sco_gseg_owner:
> @@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg)
> ret = -EINVAL;
> }
> gru_unlock_gts(gts);
> + if (ret) {
> + gru_unload_context(gts, 1);
> + ret = -EINVAL;
> + }
>
> return ret;
> }
> diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
> index 9afda47efbf2..77becb52f550 100644
> --- a/drivers/misc/sgi-gru/grumain.c
> +++ b/drivers/misc/sgi-gru/grumain.c
> @@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
> * chiplet. Misassignment can occur if the process migrates to a different
> * blade or if the user changes the selected blade/chiplet.
> */
> -void gru_check_context_placement(struct gru_thread_state *gts)
> +int gru_check_context_placement(struct gru_thread_state *gts)
> {
> struct gru_state *gru;
> + int ret = 0;
>
> /*
> * If the current task is the context owner, verify that the
> @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts)
> */
> gru = gts->ts_gru;
> if (!gru || gts->ts_tgid_owner != current->tgid)
> - return;
> + return ret;
>
> if (!gru_check_chiplet_assignment(gru, gts)) {
> STAT(check_context_unload);
> - gru_unload_context(gts, 1);
> + ret = -EINVAL;
> } else if (gru_retarget_intr(gts)) {
> STAT(check_context_retarget_intr);
> }
> +
> + return ret;
> }
>
>
> @@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
> struct gru_thread_state *gts;
> unsigned long paddr, vaddr;
> unsigned long expires;
> + int ret;
>
> vaddr = vmf->address;
> gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
> @@ -934,7 +938,13 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
> mutex_lock(&gts->ts_ctxlock);
> preempt_disable();
>
> - gru_check_context_placement(gts);
> + ret = gru_check_context_placement(gts);
> + if (ret) {

One suggestion, there is now no need to declare 'ret'. Do this instead:
if (gru_check_context_placement(gts)) {

> + preempt_enable();
> + mutex_unlock(&gts->ts_ctxlock);
> + gru_unload_context(gts, 1);
> + return VM_FAULT_NOPAGE;
> + }
>
> if (!gts->ts_gru) {
> STAT(load_user_context);
> diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
> index 5efc869fe59a..f4a5a787685f 100644
> --- a/drivers/misc/sgi-gru/grutables.h
> +++ b/drivers/misc/sgi-gru/grutables.h
> @@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
> extern int gru_user_unload_context(unsigned long arg);
> extern int gru_get_exception_detail(unsigned long arg);
> extern int gru_set_context_option(unsigned long address);
> -extern void gru_check_context_placement(struct gru_thread_state *gts);
> +extern int gru_check_context_placement(struct gru_thread_state *gts);
> extern int gru_cpu_fault_map_id(void);
> extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
> extern void gru_flush_all_tlb(struct gru_state *gru);
> --
> 2.25.1

2022-10-27 03:16:59

by Zheng Hacker

Subject: Re: [PATCH v4] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os

Hi Dimitri Sivanich,

Sorry for my late reply. I was a little busy last week. I'll check the
code right now and let you know.

Thanks for your suggestion :)

Best Regards,
Zheng Wang

Dimitri Sivanich <[email protected]> 于2022年10月19日周三 22:00写道：
>
> On Wed, Oct 19, 2022 at 11:14:45AM +0800, Zheng Wang wrote:
> > Gts may be freed in gru_check_chiplet_assignment.
> > The caller still use it after that, UAF happens.
> >
> > Fix it by introducing a return value to see if it's in error path or not.
> > Free the gts in caller if gru_check_chiplet_assignment check failed.
> >
> > Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2")
> > Reported-by: Zheng Wang <[email protected]>
> > Signed-off-by: Zheng Wang <[email protected]>
> > ---
> > v4:
> > - use VM_FAULT_NOPAGE as failure code in gru_fault and -EINVAL in other functions suggested by Yejian
> >
> > v3:
> > - add preempt_enable and use VM_FAULT_NOPAGE as failure code suggested by Yejian
> >
> > v2:
> > - commit message changes suggested by Greg
> >
> > v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/
> > ---
> > drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++--
> > drivers/misc/sgi-gru/grumain.c | 18 ++++++++++++++----
> > drivers/misc/sgi-gru/grutables.h | 2 +-
> > 3 files changed, 27 insertions(+), 7 deletions(-)
> >
> > diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
> > index d7ef61e602ed..2b5b049fbd38 100644
> > --- a/drivers/misc/sgi-gru/grufault.c
> > +++ b/drivers/misc/sgi-gru/grufault.c
> > @@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb)
> > if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
> > goto exit;
> >
> > - gru_check_context_placement(gts);
> > + ret = gru_check_context_placement(gts);
> > + if (ret)
> > + goto err;
> >
> > /*
> > * CCH may contain stale data if ts_force_cch_reload is set.
> > @@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb)
> > exit:
> > gru_unlock_gts(gts);
> > return ret;
> > +err:
> > + gru_unlock_gts(gts);
> > + gru_unload_context(gts, 1);
> > + return -EINVAL;
> > }
> >
> > /*
> > @@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg)
> > } else {
> > gts->ts_user_blade_id = req.val1;
> > gts->ts_user_chiplet_id = req.val0;
> > - gru_check_context_placement(gts);
> > + ret = gru_check_context_placement(gts);
>
> In gru_set_context_option(), you are calling gru_unload_context() for all
> non-zero 'ret' values, but there are other instances where non-zero 'ret'
> values are being set that should not call gru_unload_context(). Maybe do
> this instead:
> if (gru_check_context_placement(gts)) {
> gru_unlock_gts(gts);
> gru_unload_context(gts, 1);
> return -EINVAL;
> }
>
> > }
> > break;
> > case sco_gseg_owner:
> > @@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg)
> > ret = -EINVAL;
> > }
> > gru_unlock_gts(gts);
> > + if (ret) {
> > + gru_unload_context(gts, 1);
> > + ret = -EINVAL;
> > + }
> >
> > return ret;
> > }
> > diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
> > index 9afda47efbf2..77becb52f550 100644
> > --- a/drivers/misc/sgi-gru/grumain.c
> > +++ b/drivers/misc/sgi-gru/grumain.c
> > @@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
> > * chiplet. Misassignment can occur if the process migrates to a different
> > * blade or if the user changes the selected blade/chiplet.
> > */
> > -void gru_check_context_placement(struct gru_thread_state *gts)
> > +int gru_check_context_placement(struct gru_thread_state *gts)
> > {
> > struct gru_state *gru;
> > + int ret = 0;
> >
> > /*
> > * If the current task is the context owner, verify that the
> > @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts)
> > */
> > gru = gts->ts_gru;
> > if (!gru || gts->ts_tgid_owner != current->tgid)
> > - return;
> > + return ret;
> >
> > if (!gru_check_chiplet_assignment(gru, gts)) {
> > STAT(check_context_unload);
> > - gru_unload_context(gts, 1);
> > + ret = -EINVAL;
> > } else if (gru_retarget_intr(gts)) {
> > STAT(check_context_retarget_intr);
> > }
> > +
> > + return ret;
> > }
> >
> >
> > @@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
> > struct gru_thread_state *gts;
> > unsigned long paddr, vaddr;
> > unsigned long expires;
> > + int ret;
> >
> > vaddr = vmf->address;
> > gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
> > @@ -934,7 +938,13 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
> > mutex_lock(&gts->ts_ctxlock);
> > preempt_disable();
> >
> > - gru_check_context_placement(gts);
> > + ret = gru_check_context_placement(gts);
> > + if (ret) {
>
> One suggestion, there is now no need to declare 'ret'. Do this instead:
> if (gru_check_context_placement(gts)) {
>
> > + preempt_enable();
> > + mutex_unlock(&gts->ts_ctxlock);
> > + gru_unload_context(gts, 1);
> > + return VM_FAULT_NOPAGE;
> > + }
> >
> > if (!gts->ts_gru) {
> > STAT(load_user_context);
> > diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
> > index 5efc869fe59a..f4a5a787685f 100644
> > --- a/drivers/misc/sgi-gru/grutables.h
> > +++ b/drivers/misc/sgi-gru/grutables.h
> > @@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
> > extern int gru_user_unload_context(unsigned long arg);
> > extern int gru_get_exception_detail(unsigned long arg);
> > extern int gru_set_context_option(unsigned long address);
> > -extern void gru_check_context_placement(struct gru_thread_state *gts);
> > +extern int gru_check_context_placement(struct gru_thread_state *gts);
> > extern int gru_cpu_fault_map_id(void);
> > extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
> > extern void gru_flush_all_tlb(struct gru_state *gru);
> > --
> > 2.25.1

2022-10-27 04:07:17

by Zheng Hacker

Subject: Re: [PATCH v4] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os

Dimitri Sivanich <[email protected]> 于2022年10月19日周三 22:00写道：

> In gru_set_context_option(), you are calling gru_unload_context() for all
> non-zero 'ret' values, but there are other instances where non-zero 'ret'
> values are being set that should not call gru_unload_context(). Maybe do
> this instead:
> if (gru_check_context_placement(gts)) {
> gru_unlock_gts(gts);
> gru_unload_context(gts, 1);
> return -EINVAL;
> }
>
> > }
> > break;
> > case sco_gseg_owner:

Yes, that's correct. I'll fix it later.

> > @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts)
> > */
> > gru = gts->ts_gru;

> > - gru_check_context_placement(gts);
> > + ret = gru_check_context_placement(gts);
> > + if (ret) {
>
> One suggestion, there is now no need to declare 'ret'. Do this instead:
> if (gru_check_context_placement(gts)) {
>
> > + preempt_enable();
> > + mutex_unlock(&gts->ts_ctxlock);
> > + gru_unload_context(gts, 1);
> > + return VM_FAULT_NOPAGE;
> > + }
> >
> > if (!gts->ts_gru) {
> > STAT(load_user_context);

Get it! Thanks agagin for your advice :)

Regards,
Zheng Wang