Received: by 2002:a05:6a10:c604:0:0:0:0 with SMTP id y4csp3757330pxt; Tue, 10 Aug 2021 10:36:15 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwja54yUVOfIf0c8fEHZk73h/Z0l6QJEI4vK1vf2Jn/m0PwE+Gu4mOB6aa2MdYv6q+i/kgK X-Received: by 2002:a50:8fe1:: with SMTP id y88mr6249224edy.101.1628616974832; Tue, 10 Aug 2021 10:36:14 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1628616974; cv=none; d=google.com; s=arc-20160816; b=VZj3KAI2iZGbuj35iPqEVv1CYOfm/ht2rrj6FBxEYsWRFfgwtYP2NfyI8SuqyaoEIn j+h3zOir1gRT2nvlIQwVWxjwgIM31pSJCVmW54dzVQ7x52LeLjZ1bTOyrzAE1rwua/ip /gtfTOesrYkRVZ557sWgdn5D9C71bBB6ZY5NwCtSbBxxyRWN+ddixp64w2EXtSd2NV/B oB2l3BJjfrTEpQgliwfRkBCpSj04btIPI33mKysu3gAONYuXxnTcCGPn8yeyJAHS23xV XFT7GPUlOlqSsIzmWkY7mCcYDDpox27zdFOxrRig3wFFj4dsglO5voFYzt4I/ysj1KH/ OaXQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=UnGgj2FuNSEMFJTophI6NeHrSaP+JA0vkABsflgZtdI=; b=0Jdl6LRink4494cMt8VgXsSdUUj8zdQpbTmvpMPM1FYAYX9KAVaiRQ5w0T/fX8higO fgmdRJiEPkcnAczIR6s2M1hNl2QcOZOkNEfOhguE02c23TSrHVE15LCvNtc6LcZP0gcB vszrv7GHq/SFFmt5DM1wd2RDyXr25lsiKUsjzbAp5jMYxXhnZqoKMi+k3HPsze1sqQAr gjCwBCmj5IIjAWnS8EmybtafFaa3IvB6eoiq1Ac9FdQmYumWnpfhYApL7UcYhR9H82Hx 8ZMTTIPqbFkr8IbiftUtEXAqWUpVOGOf13jhY/pGbdMqRarVRK/QxFqlufOStqkELu3x jOYQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hiSBmaOm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id ch14si10391116ejb.650.2021.08.10.10.35.49; Tue, 10 Aug 2021 10:36:14 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hiSBmaOm; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232214AbhHJRdg (ORCPT + 99 others); Tue, 10 Aug 2021 13:33:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:33530 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232161AbhHJRdG (ORCPT ); Tue, 10 Aug 2021 13:33:06 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EA72C60EBD; Tue, 10 Aug 2021 17:32:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1628616764; bh=0oWdoNn44QZtzLfp5PWAsDx3Jinl+hraGHzZFa0gNr8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hiSBmaOmi5EE6dqVGTgKU40RA4/jttHC+O7W1EfvPqpH4wxaN4uDmzMp6LMcmah5K 0XlLEZbkdvyANk90vQ9MRuKRxEGfLeYelpervJZRv686kQP8iqZAi109i0dNFtyY2F NAQZ2JRlcyUTFy3ObjbKoHZ69qbJKWrVqkYVMHiI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tyler Hicks , Jens Wiklander , Sumit Garg Subject: [PATCH 4.19 35/54] optee: Clear stale cache entries during initialization Date: Tue, 10 Aug 2021 19:30:29 +0200 Message-Id: <20210810172945.336794400@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210810172944.179901509@linuxfoundation.org> References: <20210810172944.179901509@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tyler Hicks commit b5c10dd04b7418793517e3286cde5c04759a86de upstream. The shm cache could contain invalid addresses if optee_disable_shm_cache() was not called from the .shutdown hook of the previous kernel before a kexec. These addresses could be unmapped or they could point to mapped but unintended locations in memory. Clear the shared memory cache, while being careful to not translate the addresses returned from OPTEE_SMC_DISABLE_SHM_CACHE, during driver initialization. Once all pre-cache shm objects are removed, proceed with enabling the cache so that we know that we can handle cached shm objects with confidence later in the .shutdown hook. Cc: stable@vger.kernel.org Signed-off-by: Tyler Hicks Reviewed-by: Jens Wiklander Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman --- drivers/tee/optee/call.c | 36 +++++++++++++++++++++++++++++++++--- drivers/tee/optee/core.c | 9 +++++++++ drivers/tee/optee/optee_private.h | 1 + 3 files changed, 43 insertions(+), 3 deletions(-) --- a/drivers/tee/optee/call.c +++ b/drivers/tee/optee/call.c @@ -413,11 +413,13 @@ void optee_enable_shm_cache(struct optee } /** - * optee_disable_shm_cache() - Disables caching of some shared memory allocation - * in OP-TEE + * __optee_disable_shm_cache() - Disables caching of some shared memory + * allocation in OP-TEE * @optee: main service struct + * @is_mapped: true if the cached shared memory addresses were mapped by this + * kernel, are safe to dereference, and should be freed */ -void optee_disable_shm_cache(struct optee *optee) +static void __optee_disable_shm_cache(struct optee *optee, bool is_mapped) { struct optee_call_waiter w; @@ -436,6 +438,13 @@ void optee_disable_shm_cache(struct opte if (res.result.status == OPTEE_SMC_RETURN_OK) { struct tee_shm *shm; + /* + * Shared memory references that were not mapped by + * this kernel must be ignored to prevent a crash. + */ + if (!is_mapped) + continue; + shm = reg_pair_to_ptr(res.result.shm_upper32, res.result.shm_lower32); tee_shm_free(shm); @@ -446,6 +455,27 @@ void optee_disable_shm_cache(struct opte optee_cq_wait_final(&optee->call_queue, &w); } +/** + * optee_disable_shm_cache() - Disables caching of mapped shared memory + * allocations in OP-TEE + * @optee: main service struct + */ +void optee_disable_shm_cache(struct optee *optee) +{ + return __optee_disable_shm_cache(optee, true); +} + +/** + * optee_disable_unmapped_shm_cache() - Disables caching of shared memory + * allocations in OP-TEE which are not + * currently mapped + * @optee: main service struct + */ +void optee_disable_unmapped_shm_cache(struct optee *optee) +{ + return __optee_disable_shm_cache(optee, false); +} + #define PAGELIST_ENTRIES_PER_PAGE \ ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1) --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -619,6 +619,15 @@ static struct optee *optee_probe(struct optee->memremaped_shm = memremaped_shm; optee->pool = pool; + /* + * Ensure that there are no pre-existing shm objects before enabling + * the shm cache so that there's no chance of receiving an invalid + * address during shutdown. This could occur, for example, if we're + * kexec booting from an older kernel that did not properly cleanup the + * shm cache. + */ + optee_disable_unmapped_shm_cache(optee); + optee_enable_shm_cache(optee); pr_info("initialized driver\n"); --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -160,6 +160,7 @@ int optee_cancel_req(struct tee_context void optee_enable_shm_cache(struct optee *optee); void optee_disable_shm_cache(struct optee *optee); +void optee_disable_unmapped_shm_cache(struct optee *optee); int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm, struct page **pages, size_t num_pages,