Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp1653420pxb; Thu, 16 Sep 2021 12:08:05 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxk9MoAGhACV+1Hif4nmKXJLIWbOiltC4n/diTEi6C8TcVgxEvtvNtGIw0o1pc2GH2qAP+Y X-Received: by 2002:a17:906:cc4b:: with SMTP id mm11mr8101541ejb.421.1631819285716; Thu, 16 Sep 2021 12:08:05 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631819285; cv=none; d=google.com; s=arc-20160816; b=EqjJ+5sXsxGxw93e/WOLXN7veLuc/lkXxIFNGVxjxKQOMp8D6IQuRIWk2/3JXaZ4Xh bv7X0bavIJi3GMr1ydDeCJPfjV6cPcnoDQht6ih3VyjCEQCT261h0JsNQBEvaUoDUoi/ gJOLzBuQdSxON1Ek66fRjOh5gb9Z82m3mVVu8bGJA1sAqDDYiFG81xKUD4Uf3kkwHEwR Jq4sG+DeuLhbmHbkdeP6bSErkVyLepqDN0LqjMo3Rxzkrfs8yey0oeEOEkMDR9NcxH+K 0XA/uwbaXQnBtk4FUaUI3OBIql+Nrg3y82JCs43hxY9qtiC59TlPuqFHCdvbjLcTAjzx Hxig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=IA7I3ZZkLA9YMjP6gvmrSWhEyU0QtWhXuCvV/9wHT/c=; b=ucmd16igGYSLa5IQR06MULmyeAVNBXEyLcBsSPMwUt/5EABFNr8RCU+ZV0hlxuc0Po FVsGUGQsWgsoYjjJcY+gxSeg318DdywgqXOco+vjAf+xfuepxylbUAUfp5euMVFaS+ho ZsOAr9d1CKURXZyQpF6UjSJw6SU5DOrOFFBNkcXBlz6LzuMnw+YzACnXagpMa262xkOv 5P6bF8fklq38PgsUuEBdiBk5d3UsZ7XQ1+gEHIDGETivRYUzgDq1nPfdotYp1qJIXcwC TAg0US3ZkeL/zEOIyQ5ZyzjtzdPor1LZLVDL/OeNa5xqKVdIO+LM+IZQ+vKQ/LCFgtYn gW0A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Ah9FwbcP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id jl23si3991948ejc.753.2021.09.16.12.07.41; Thu, 16 Sep 2021 12:08:05 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Ah9FwbcP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234461AbhIPQM0 (ORCPT + 99 others); Thu, 16 Sep 2021 12:12:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:47588 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232392AbhIPQHn (ORCPT ); Thu, 16 Sep 2021 12:07:43 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id EC86661351; Thu, 16 Sep 2021 16:06:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1631808378; bh=QlJJ9g6oDafpKf1UXnmxpl/ubm3+gpg3qtxl0d4dDoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ah9FwbcPhEusaHGByZoAOr3q1ccd2bVuQ0zNRYbnCfkDeBcmyPcV43fqle6CW/JTb 4FWyKunft784OnMxeEpUbz9I9LeUOozQ4R+Xl2J18+eHgVc7d6IncDZt3K0Yk4psth x8IGKfPdidFMTKaYxtFOrK4YUDqK1i4NeRDsY8k8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Jorgen Hansen , Wang Hai Subject: [PATCH 5.10 036/306] VMCI: fix NULL pointer dereference when unmapping queue pair Date: Thu, 16 Sep 2021 17:56:21 +0200 Message-Id: <20210916155755.178000563@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210916155753.903069397@linuxfoundation.org> References: <20210916155753.903069397@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Wang Hai commit a30dc6cf0dc51419021550152e435736aaef8799 upstream. I got a NULL pointer dereference report when doing fuzz test: Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM. vmci_host_unlocked_ioctl vmci_host_do_alloc_queuepair vmci_qp_broker_alloc qp_broker_alloc qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM; When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation. Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker. Only when the qp broker has no mem, it can register the user memory when mapping the qp broker. Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") Cc: stable Reported-by: Hulk Robot Reviewed-by: Jorgen Hansen Signed-off-by: Wang Hai Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com Signed-off-by: Greg Kroah-Hartman --- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -2238,7 +2238,8 @@ int vmci_qp_broker_map(struct vmci_handl result = VMCI_SUCCESS; - if (context_id != VMCI_HOST_CONTEXT_ID) { + if (context_id != VMCI_HOST_CONTEXT_ID && + !QPBROKERSTATE_HAS_MEM(entry)) { struct vmci_qp_page_store page_store; page_store.pages = guest_mem; @@ -2345,7 +2346,8 @@ int vmci_qp_broker_unmap(struct vmci_han goto out; } - if (context_id != VMCI_HOST_CONTEXT_ID) { + if (context_id != VMCI_HOST_CONTEXT_ID && + QPBROKERSTATE_HAS_MEM(entry)) { qp_acquire_queue_mutex(entry->produce_q); result = qp_save_headers(entry); if (result < VMCI_SUCCESS)