Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20221019031445.901570-1-zyytlz.wz@163.com> <20221019140043.GD18792@hpe.com>
In-Reply-To: <20221019140043.GD18792@hpe.com>
From:   Zheng Hacker <hackerzheng666@gmail.com>
Date:   Thu, 27 Oct 2022 11:48:27 +0800
Message-ID: <CAJedcCzDz6zEn2c2fb10DsJGGw1H1RWC98Fsr+x3sF5e-E43Sg@mail.gmail.com>
Subject: Re: [PATCH v4] misc: sgi-gru: fix use-after-free error in
 gru_set_context_option, gru_fault and gru_handle_user_call_os
To:     Dimitri Sivanich <sivanich@hpe.com>
Cc:     Zheng Wang <zyytlz.wz@163.com>, gregkh@linuxfoundation.org,
        zhengyejian1@huawei.com, dimitri.sivanich@hpe.com, arnd@arndb.de,
        linux-kernel@vger.kernel.org, alex000young@gmail.com,
        security@kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Dimitri Sivanich <sivanich@hpe.com> =E4=BA=8E2022=E5=B9=B410=E6=9C=8819=E6=
=97=A5=E5=91=A8=E4=B8=89 22:00=E5=86=99=E9=81=93=EF=BC=9A

> In gru_set_context_option(), you are calling gru_unload_context() for all
> non-zero 'ret' values, but there are other instances where non-zero 'ret'
> values are being set that should not call gru_unload_context().  Maybe do
> this instead:
>                         if (gru_check_context_placement(gts)) {
>                                 gru_unlock_gts(gts);
>                                 gru_unload_context(gts, 1);
>                                 return -EINVAL;
>                         }
>
> >               }
> >               break;
> >       case sco_gseg_owner:

Yes, that's correct. I'll fix it later.

> > @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_threa=
d_state *gts)
> >        */
> >       gru =3D gts->ts_gru;

> > -     gru_check_context_placement(gts);
> > +     ret =3D gru_check_context_placement(gts);
> > +     if (ret) {
>
> One suggestion, there is now no need to declare 'ret'.  Do this instead:
>         if (gru_check_context_placement(gts)) {
>
> > +             preempt_enable();
> > +             mutex_unlock(&gts->ts_ctxlock);
> > +             gru_unload_context(gts, 1);
> > +             return VM_FAULT_NOPAGE;
> > +     }
> >
> >       if (!gts->ts_gru) {
> >               STAT(load_user_context);

Get it! Thanks agagin for your advice :)

Regards,
Zheng Wang