A race condition may occur if the user physically removes the
ffa_abi device while calling open().
This is a race condition between optee_open() function and
the optee_ffa_remove() function, which may lead to Use-After-Free.
Therefore, add a refcount check to optee_ffa_remove() function
to free the "optee" structure after the device is close()d.
---------------CPU 0--------------------CPU 1-----------------
optee_open() | optee_ffa_remove()
--------------------------------------------------------------
struct optee *optee = tee_get_|
drvdata(teedev); — (1) |
| struct optee *optee = ffa_dev_
| get_drvdata(ffa_dev);
| ...
| kfree(optee); — (2)
if (teedev == optee->supp_ |
teedev) { — (3) |
Signed-off-by: Yoochan Lee <[email protected]>
---
drivers/tee/optee/ffa_abi.c | 49 +++++++++++++++++++++++++------
drivers/tee/optee/optee_private.h | 1 +
2 files changed, 41 insertions(+), 9 deletions(-)
diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c
index 0828240f27e6..ea76d7532419 100644
--- a/drivers/tee/optee/ffa_abi.c
+++ b/drivers/tee/optee/ffa_abi.c
@@ -726,15 +726,52 @@ static void optee_ffa_get_version(struct tee_device *teedev,
*vers = v;
}
+static void optee_ffa_delete(struct kref *kref)
+{
+ struct optee *optee = container_of(kref, struct optee, refcnt);
+
+ optee_remove_common(optee);
+
+ mutex_destroy(&optee->ffa.mutex);
+ rhashtable_free_and_destroy(&optee->ffa.global_ids, rh_free_fn, NULL);
+
+ kfree(optee);
+
+}
+
+static void optee_ffa_release(struct tee_context *ctx)
+{
+ struct optee *optee = tee_get_drvdata(teedev);
+
+ optee_release_helper(ctx, optee_close_session_helper);
+ kref_put(&optee->refcnt, optee_ffa_delete);
+}
+
+void optee_ffa_release_supp(struct tee_context *ctx)
+{
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
+
+ optee_release_helper(ctx, optee_close_session_helper);
+ if (optee->scan_bus_wq) {
+ destroy_workqueue(optee->scan_bus_wq);
+ optee->scan_bus_wq = NULL;
+ }
+ optee_supp_release(&optee->supp);
+ kref_put(&optee->refcnt, optee_ffa_delete);
+}
+
static int optee_ffa_open(struct tee_context *ctx)
{
+ struct optee *optee = tee_get_drvdata(teedev);
+ kref_get(&optee->refcnt);
+
return optee_open(ctx, true);
}
static const struct tee_driver_ops optee_ffa_clnt_ops = {
.get_version = optee_ffa_get_version,
.open = optee_ffa_open,
- .release = optee_release,
+ .release = optee_ffa_release,
.open_session = optee_open_session,
.close_session = optee_close_session,
.invoke_func = optee_invoke_func,
@@ -752,7 +789,7 @@ static const struct tee_desc optee_ffa_clnt_desc = {
static const struct tee_driver_ops optee_ffa_supp_ops = {
.get_version = optee_ffa_get_version,
.open = optee_ffa_open,
- .release = optee_release_supp,
+ .release = optee_ffa_release_supp,
.supp_recv = optee_supp_recv,
.supp_send = optee_supp_send,
.shm_register = optee_ffa_shm_register, /* same as for clnt ops */
@@ -775,13 +812,7 @@ static const struct optee_ops optee_ffa_ops = {
static void optee_ffa_remove(struct ffa_device *ffa_dev)
{
struct optee *optee = ffa_dev_get_drvdata(ffa_dev);
-
- optee_remove_common(optee);
-
- mutex_destroy(&optee->ffa.mutex);
- rhashtable_free_and_destroy(&optee->ffa.global_ids, rh_free_fn, NULL);
-
- kfree(optee);
+ kref_put(&optee->refcnt, optee_ffa_delete);
}
static int optee_ffa_probe(struct ffa_device *ffa_dev)
diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h
index 04ae58892608..f52b1cf20eab 100644
--- a/drivers/tee/optee/optee_private.h
+++ b/drivers/tee/optee/optee_private.h
@@ -175,6 +175,7 @@ struct optee {
bool scan_bus_done;
struct workqueue_struct *scan_bus_wq;
struct work_struct scan_bus_work;
+ struct kref refcnt;
};
struct optee_session {
--
2.39.0
Hi Yoochan,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on v6.2-rc1 next-20221226]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
patch link: https://lore.kernel.org/r/20221231053421.2039591-1-yoochan1026%40gmail.com
patch subject: [PATCH] tee: optee: ffa_abi: Fix use-after-free in optee_ffa_open
config: arm-randconfig-c002-20221231
compiler: clang version 16.0.0 (https://github.com/llvm/llvm-project f5700e7b69048de958172fb513b336564e7f8709)
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# install arm cross compiling tool for clang build
# apt-get install binutils-arm-linux-gnueabi
# https://github.com/intel-lab-lkp/linux/commit/3fe68a00d912f9e5dbec5002a7d30cf2a0868679
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
git checkout 3fe68a00d912f9e5dbec5002a7d30cf2a0868679
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/tee/optee/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <[email protected]>
All error/warnings (new ones prefixed by >>):
>> drivers/tee/optee/ffa_abi.c:744:40: error: use of undeclared identifier 'teedev'
struct optee *optee = tee_get_drvdata(teedev);
^
>> drivers/tee/optee/ffa_abi.c:746:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
optee_release_helper(ctx, optee_close_session_helper);
^
drivers/tee/optee/ffa_abi.c:746:2: note: did you mean 'optee_release_supp'?
drivers/tee/optee/optee_private.h:258:6: note: 'optee_release_supp' declared here
void optee_release_supp(struct tee_context *ctx);
^
drivers/tee/optee/ffa_abi.c:754:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
optee_release_helper(ctx, optee_close_session_helper);
^
>> drivers/tee/optee/ffa_abi.c:750:6: warning: no previous prototype for function 'optee_ffa_release_supp' [-Wmissing-prototypes]
void optee_ffa_release_supp(struct tee_context *ctx)
^
drivers/tee/optee/ffa_abi.c:750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
void optee_ffa_release_supp(struct tee_context *ctx)
^
static
drivers/tee/optee/ffa_abi.c:765:40: error: use of undeclared identifier 'teedev'
struct optee *optee = tee_get_drvdata(teedev);
^
1 warning and 4 errors generated.
vim +/teedev +744 drivers/tee/optee/ffa_abi.c
741
742 static void optee_ffa_release(struct tee_context *ctx)
743 {
> 744 struct optee *optee = tee_get_drvdata(teedev);
745
> 746 optee_release_helper(ctx, optee_close_session_helper);
747 kref_put(&optee->refcnt, optee_ffa_delete);
748 }
749
> 750 void optee_ffa_release_supp(struct tee_context *ctx)
751 {
752 struct optee *optee = tee_get_drvdata(ctx->teedev);
753
754 optee_release_helper(ctx, optee_close_session_helper);
755 if (optee->scan_bus_wq) {
756 destroy_workqueue(optee->scan_bus_wq);
757 optee->scan_bus_wq = NULL;
758 }
759 optee_supp_release(&optee->supp);
760 kref_put(&optee->refcnt, optee_ffa_delete);
761 }
762
--
0-DAY CI Kernel Test Service
https://01.org/lkp
I fix the error in the previous patch.
From fde49d86f6401789ba51f267a0d79fbe4e7ffc24 Mon Sep 17 00:00:00 2001
From: Yoochan Lee <[email protected]>
Date: Mon, 2 Jan 2023 09:16:05 +0900
Subject: [PATCH 2/2] fix errors in previous patch
---
drivers/tee/optee/ffa_abi.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)
diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c
index ea76d7532419..65d9463d9ed8 100644
--- a/drivers/tee/optee/ffa_abi.c
+++ b/drivers/tee/optee/ffa_abi.c
@@ -741,28 +741,23 @@ static void optee_ffa_delete(struct kref *kref)
static void optee_ffa_release(struct tee_context *ctx)
{
- struct optee *optee = tee_get_drvdata(teedev);
-
- optee_release_helper(ctx, optee_close_session_helper);
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
+
+ optee_release(ctx);
kref_put(&optee->refcnt, optee_ffa_delete);
}
void optee_ffa_release_supp(struct tee_context *ctx)
{
struct optee *optee = tee_get_drvdata(ctx->teedev);
-
- optee_release_helper(ctx, optee_close_session_helper);
- if (optee->scan_bus_wq) {
- destroy_workqueue(optee->scan_bus_wq);
- optee->scan_bus_wq = NULL;
- }
- optee_supp_release(&optee->supp);
+
+ optee_release_supp(ctx);
kref_put(&optee->refcnt, optee_ffa_delete);
}
static int optee_ffa_open(struct tee_context *ctx)
{
- struct optee *optee = tee_get_drvdata(teedev);
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
kref_get(&optee->refcnt);
return optee_open(ctx, true);
--
2.39.0
2023년 1월 2일 (월) 오전 5:12, kernel test robot <[email protected]>님이 작성:
>
> Hi Yoochan,
>
> Thank you for the patch! Yet something to improve:
>
> [auto build test ERROR on linus/master]
> [also build test ERROR on v6.2-rc1 next-20221226]
> [If your patch is applied to the wrong git tree, kindly drop us a note.
> And when submitting patch, we suggest to use '--base' as documented in
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
> patch link: https://lore.kernel.org/r/20221231053421.2039591-1-yoochan1026%40gmail.com
> patch subject: [PATCH] tee: optee: ffa_abi: Fix use-after-free in optee_ffa_open
> config: arm-randconfig-c002-20221231
> compiler: clang version 16.0.0 (https://github.com/llvm/llvm-project f5700e7b69048de958172fb513b336564e7f8709)
> reproduce (this is a W=1 build):
> wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
> chmod +x ~/bin/make.cross
> # install arm cross compiling tool for clang build
> # apt-get install binutils-arm-linux-gnueabi
> # https://github.com/intel-lab-lkp/linux/commit/3fe68a00d912f9e5dbec5002a7d30cf2a0868679
> git remote add linux-review https://github.com/intel-lab-lkp/linux
> git fetch --no-tags linux-review Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
> git checkout 3fe68a00d912f9e5dbec5002a7d30cf2a0868679
> # save the config file
> mkdir build_dir && cp config build_dir/.config
> COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm olddefconfig
> COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/tee/optee/
>
> If you fix the issue, kindly add following tag where applicable
> | Reported-by: kernel test robot <[email protected]>
>
> All error/warnings (new ones prefixed by >>):
>
> >> drivers/tee/optee/ffa_abi.c:744:40: error: use of undeclared identifier 'teedev'
> struct optee *optee = tee_get_drvdata(teedev);
> ^
> >> drivers/tee/optee/ffa_abi.c:746:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
> optee_release_helper(ctx, optee_close_session_helper);
> ^
> drivers/tee/optee/ffa_abi.c:746:2: note: did you mean 'optee_release_supp'?
> drivers/tee/optee/optee_private.h:258:6: note: 'optee_release_supp' declared here
> void optee_release_supp(struct tee_context *ctx);
> ^
> drivers/tee/optee/ffa_abi.c:754:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
> optee_release_helper(ctx, optee_close_session_helper);
> ^
> >> drivers/tee/optee/ffa_abi.c:750:6: warning: no previous prototype for function 'optee_ffa_release_supp' [-Wmissing-prototypes]
> void optee_ffa_release_supp(struct tee_context *ctx)
> ^
> drivers/tee/optee/ffa_abi.c:750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
> void optee_ffa_release_supp(struct tee_context *ctx)
> ^
> static
> drivers/tee/optee/ffa_abi.c:765:40: error: use of undeclared identifier 'teedev'
> struct optee *optee = tee_get_drvdata(teedev);
> ^
> 1 warning and 4 errors generated.
>
>
> vim +/teedev +744 drivers/tee/optee/ffa_abi.c
>
> 741
> 742 static void optee_ffa_release(struct tee_context *ctx)
> 743 {
> > 744 struct optee *optee = tee_get_drvdata(teedev);
> 745
> > 746 optee_release_helper(ctx, optee_close_session_helper);
> 747 kref_put(&optee->refcnt, optee_ffa_delete);
> 748 }
> 749
> > 750 void optee_ffa_release_supp(struct tee_context *ctx)
> 751 {
> 752 struct optee *optee = tee_get_drvdata(ctx->teedev);
> 753
> 754 optee_release_helper(ctx, optee_close_session_helper);
> 755 if (optee->scan_bus_wq) {
> 756 destroy_workqueue(optee->scan_bus_wq);
> 757 optee->scan_bus_wq = NULL;
> 758 }
> 759 optee_supp_release(&optee->supp);
> 760 kref_put(&optee->refcnt, optee_ffa_delete);
> 761 }
> 762
>
> --
> 0-DAY CI Kernel Test Service
> https://01.org/lkp
Hi,
On Mon, Jan 2, 2023 at 1:17 AM Yoochan Lee <[email protected]> wrote:
>
> I fix the error in the previous patch.
>
> From fde49d86f6401789ba51f267a0d79fbe4e7ffc24 Mon Sep 17 00:00:00 2001
> From: Yoochan Lee <[email protected]>
> Date: Mon, 2 Jan 2023 09:16:05 +0900
> Subject: [PATCH 2/2] fix errors in previous patch
>
> ---
> drivers/tee/optee/ffa_abi.c | 17 ++++++-----------
> 1 file changed, 6 insertions(+), 11 deletions(-)
Please fix up the original patch and post it as a v2. By the way, have
you tried to test this in some way?
Thanks,
Jens
>
> diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c
> index ea76d7532419..65d9463d9ed8 100644
> --- a/drivers/tee/optee/ffa_abi.c
> +++ b/drivers/tee/optee/ffa_abi.c
> @@ -741,28 +741,23 @@ static void optee_ffa_delete(struct kref *kref)
>
> static void optee_ffa_release(struct tee_context *ctx)
> {
> - struct optee *optee = tee_get_drvdata(teedev);
> -
> - optee_release_helper(ctx, optee_close_session_helper);
> + struct optee *optee = tee_get_drvdata(ctx->teedev);
> +
> + optee_release(ctx);
> kref_put(&optee->refcnt, optee_ffa_delete);
> }
>
> void optee_ffa_release_supp(struct tee_context *ctx)
> {
> struct optee *optee = tee_get_drvdata(ctx->teedev);
> -
> - optee_release_helper(ctx, optee_close_session_helper);
> - if (optee->scan_bus_wq) {
> - destroy_workqueue(optee->scan_bus_wq);
> - optee->scan_bus_wq = NULL;
> - }
> - optee_supp_release(&optee->supp);
> +
> + optee_release_supp(ctx);
> kref_put(&optee->refcnt, optee_ffa_delete);
> }
>
> static int optee_ffa_open(struct tee_context *ctx)
> {
> - struct optee *optee = tee_get_drvdata(teedev);
> + struct optee *optee = tee_get_drvdata(ctx->teedev);
> kref_get(&optee->refcnt);
>
> return optee_open(ctx, true);
> --
> 2.39.0
>
> 2023년 1월 2일 (월) 오전 5:12, kernel test robot <[email protected]>님이 작성:
> >
> > Hi Yoochan,
> >
> > Thank you for the patch! Yet something to improve:
> >
> > [auto build test ERROR on linus/master]
> > [also build test ERROR on v6.2-rc1 next-20221226]
> > [If your patch is applied to the wrong git tree, kindly drop us a note.
> > And when submitting patch, we suggest to use '--base' as documented in
> > https://git-scm.com/docs/git-format-patch#_base_tree_information]
> >
> > url: https://github.com/intel-lab-lkp/linux/commits/Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
> > patch link: https://lore.kernel.org/r/20221231053421.2039591-1-yoochan1026%40gmail.com
> > patch subject: [PATCH] tee: optee: ffa_abi: Fix use-after-free in optee_ffa_open
> > config: arm-randconfig-c002-20221231
> > compiler: clang version 16.0.0 (https://github.com/llvm/llvm-project f5700e7b69048de958172fb513b336564e7f8709)
> > reproduce (this is a W=1 build):
> > wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
> > chmod +x ~/bin/make.cross
> > # install arm cross compiling tool for clang build
> > # apt-get install binutils-arm-linux-gnueabi
> > # https://github.com/intel-lab-lkp/linux/commit/3fe68a00d912f9e5dbec5002a7d30cf2a0868679
> > git remote add linux-review https://github.com/intel-lab-lkp/linux
> > git fetch --no-tags linux-review Yoochan-Lee/tee-optee-ffa_abi-Fix-use-after-free-in-optee_ffa_open/20221231-133611
> > git checkout 3fe68a00d912f9e5dbec5002a7d30cf2a0868679
> > # save the config file
> > mkdir build_dir && cp config build_dir/.config
> > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm olddefconfig
> > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=arm SHELL=/bin/bash drivers/tee/optee/
> >
> > If you fix the issue, kindly add following tag where applicable
> > | Reported-by: kernel test robot <[email protected]>
> >
> > All error/warnings (new ones prefixed by >>):
> >
> > >> drivers/tee/optee/ffa_abi.c:744:40: error: use of undeclared identifier 'teedev'
> > struct optee *optee = tee_get_drvdata(teedev);
> > ^
> > >> drivers/tee/optee/ffa_abi.c:746:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
> > optee_release_helper(ctx, optee_close_session_helper);
> > ^
> > drivers/tee/optee/ffa_abi.c:746:2: note: did you mean 'optee_release_supp'?
> > drivers/tee/optee/optee_private.h:258:6: note: 'optee_release_supp' declared here
> > void optee_release_supp(struct tee_context *ctx);
> > ^
> > drivers/tee/optee/ffa_abi.c:754:2: error: call to undeclared function 'optee_release_helper'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
> > optee_release_helper(ctx, optee_close_session_helper);
> > ^
> > >> drivers/tee/optee/ffa_abi.c:750:6: warning: no previous prototype for function 'optee_ffa_release_supp' [-Wmissing-prototypes]
> > void optee_ffa_release_supp(struct tee_context *ctx)
> > ^
> > drivers/tee/optee/ffa_abi.c:750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
> > void optee_ffa_release_supp(struct tee_context *ctx)
> > ^
> > static
> > drivers/tee/optee/ffa_abi.c:765:40: error: use of undeclared identifier 'teedev'
> > struct optee *optee = tee_get_drvdata(teedev);
> > ^
> > 1 warning and 4 errors generated.
> >
> >
> > vim +/teedev +744 drivers/tee/optee/ffa_abi.c
> >
> > 741
> > 742 static void optee_ffa_release(struct tee_context *ctx)
> > 743 {
> > > 744 struct optee *optee = tee_get_drvdata(teedev);
> > 745
> > > 746 optee_release_helper(ctx, optee_close_session_helper);
> > 747 kref_put(&optee->refcnt, optee_ffa_delete);
> > 748 }
> > 749
> > > 750 void optee_ffa_release_supp(struct tee_context *ctx)
> > 751 {
> > 752 struct optee *optee = tee_get_drvdata(ctx->teedev);
> > 753
> > 754 optee_release_helper(ctx, optee_close_session_helper);
> > 755 if (optee->scan_bus_wq) {
> > 756 destroy_workqueue(optee->scan_bus_wq);
> > 757 optee->scan_bus_wq = NULL;
> > 758 }
> > 759 optee_supp_release(&optee->supp);
> > 760 kref_put(&optee->refcnt, optee_ffa_delete);
> > 761 }
> > 762
> >
> > --
> > 0-DAY CI Kernel Test Service
> > https://01.org/lkp