Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <437a562e-43e5-1c06-10cd-2af81b4ef8fa@linaro.org>
Date:   Thu, 22 Sep 2022 23:45:53 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [PATCH 3/3] misc: fastrpc: Fix use-after-free race condition for
 maps
Content-Language: en-US
To:     Abel Vesa <abel.vesa@linaro.org>,
        Amol Maheshwari <amahesh@qti.qualcomm.com>,
        Ekansh Gupta <ekangupt@qti.qualcomm.com>,
        Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Cc:     Arnd Bergmann <arnd@arndb.de>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-arm-msm@vger.kernel.org,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Ola Jeppsson <ola@snap.com>
References: <20220902151423.3351414-1-abel.vesa@linaro.org>
 <20220902151423.3351414-3-abel.vesa@linaro.org>
From:   Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
In-Reply-To: <20220902151423.3351414-3-abel.vesa@linaro.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 02/09/2022 16:14, Abel Vesa wrote:
> From: Ola Jeppsson <ola@snap.com>
> 
> It is possible that in between calling fastrpc_map_get() until
> map->fl->lock is taken in fastrpc_free_map(), another thread can call
> fastrpc_map_lookup() and get a reference to a map that is about to be
> deleted.
> 
yes, there is a margin of window here.
Also am surprised to see the race for same map fd.

fastrpc_map_get() is always under a lock, have you tried adding locking 
for fastrpc_map_put().


> Rewrite fastrpc_map_get() to only increase the reference count of a map
> if it's non-zero. Propagate this to callers so they can know if a map is
> about to be deleted.
This will work but it would be better to fix the window of race.

--srini

> 
> Fixes this warning:
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate
> ...
> Call trace:
>   refcount_warn_saturate
>   [fastrpc_map_get inlined]
>   [fastrpc_map_lookup inlined]
>   fastrpc_map_create
>   fastrpc_internal_invoke
>   fastrpc_device_ioctl
>   __arm64_sys_ioctl
>   invoke_syscall
> 
> Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method")
> Signed-off-by: Ola Jeppsson <ola@snap.com>
> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
> ---
>   drivers/misc/fastrpc.c | 8 +++++---
>   1 file changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 50c17f5da3a8..58654d394d17 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -332,10 +332,12 @@ static void fastrpc_map_put(struct fastrpc_map *map)
>   		kref_put(&map->refcount, fastrpc_free_map);
>   }
>   
> -static void fastrpc_map_get(struct fastrpc_map *map)
> +static int fastrpc_map_get(struct fastrpc_map *map)
>   {
> -	if (map)
> -		kref_get(&map->refcount);
> +	if (!map)
> +		return -ENOENT;
> +
> +	return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;
>   }
>   
>