Received: by 2002:a05:6358:d09b:b0:dc:cd0c:909e with SMTP id jc27csp612587rwb; Wed, 9 Nov 2022 06:44:47 -0800 (PST) X-Google-Smtp-Source: AMsMyM7ZTghLt5w5s0K5bZt0ojWys+b283QOZHc3x0Pm+1R7Akk9v/YOszjTkhsicXpAKRC32iOP X-Received: by 2002:a17:902:b60e:b0:188:5e9a:bf6e with SMTP id b14-20020a170902b60e00b001885e9abf6emr31111145pls.96.1668005087728; Wed, 09 Nov 2022 06:44:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668005087; cv=none; d=google.com; s=arc-20160816; b=VZElG9xEXhAw2j3PZPR7nCeTZClcrA7sXZWThvxC9BHj3YBpMcr4loMPK6bFuSarFb ofAofCJ7aHQVBO+98CPyqwp8njK0NaoGA7ztJL488GIOOywf6l7jMB8GZINRlnkpsOcI el4cz082bem55Xf9kOqmGE1PJpOj/Btg83nLUAZqoveExzUpdOIq5tN83QSsr1I7RV1j HT3UMaAa7NNEfNbE6jxS6U4dVFMrnv3/Vtq2mLff2WAN3BebmOc3HMtBntcwQ1TgyoqW zvW0XNGeePuv/lyds7OSG4kK6p7ndOVDdzPJCr53fClBLa5vDpfx9Cycd1IY5KNt9npt j7iw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=1vFrUVtFiFbmRLFApIq8kFzfhMdctO7y36+7evW3UJg=; b=IN+l/0l8z4RZly+VDETAeCbxInMoWzi2NbEVj8kQbd3KlbMiI8vDLoZY0EB6mhdDHj 9vINx4LcYpkM2PhyuKXDWb8CX5CSVAPBhcf9O26yZZn5Gfp+JCD7jhj9VGZbEGZw3nXN V5wmcRs0cLovrf8fmV5Lb/ZL0tFbAiflXFdR6U6JcnqU0DNo4KG93p5wL3OLZYoTFGMO D+aLi1wODYV6Xs/kSiPrtDI0grP93wcL4DaaVqL9C+ppMFfPyWfLH/f8O744PH6mKHiR zswkbMsu+C0kqrQ/Lm5o6xP9QAThRnttjadMzfJKa8O6JoloLn6RqMR/x/U7aOL43SNK mPTw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=Kyz3ui1Z; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x66-20020a623145000000b00562fc008395si14872653pfx.341.2022.11.09.06.44.35; Wed, 09 Nov 2022 06:44:47 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=Kyz3ui1Z; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230500AbiKIOSS (ORCPT + 93 others); Wed, 9 Nov 2022 09:18:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230421AbiKIOSQ (ORCPT ); Wed, 9 Nov 2022 09:18:16 -0500 Received: from mail-m975.mail.163.com (mail-m975.mail.163.com [123.126.97.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id D4F6EE40 for ; Wed, 9 Nov 2022 06:18:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=1vFrU VtFiFbmRLFApIq8kFzfhMdctO7y36+7evW3UJg=; b=Kyz3ui1ZPYvSnQ/8L8Ocp dRgmM/8U4tRVTFuB7esraCPNJ4LQ1kjGfPkqFDmWEFyYiaFipjaFYMCtQUKTHVVC FpYEUroVl3kR4u17A987wfKGsUg8TbNkJOi0DX/E6kRh/eR+d0eJ/cobdgjCiEwv BPVWk+GeFQUA17hKQDqYbQ= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by smtp5 (Coremail) with SMTP id HdxpCgBH8MtftmtjmFBzqg--.35328S2; Wed, 09 Nov 2022 22:17:04 +0800 (CST) From: Zheng Wang To: gregkh@linuxfoundation.org Cc: zhengyejian1@huawei.com, dimitri.sivanich@hpe.com, arnd@arndb.de, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, alex000young@gmail.com, security@kernel.org, sivanich@hpe.com, lkp@intel.com, Zheng Wang Subject: [PATCH v9] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os Date: Wed, 9 Nov 2022 22:17:01 +0800 Message-Id: <20221109141701.237407-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: HdxpCgBH8MtftmtjmFBzqg--.35328S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxKryxXr13Xr47uryDZw1DZFb_yoW7Ww4fpa 1jg3409rW3XF4avr47ta1kXFW3CaykJFW5Gr9rG3s5ur4rAFs8GryDtas0qr4DZrW0qF42 yr4rtF9I93Z0vaDanT9S1TB71UUUUUDqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zR7xhLUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiQgC0U1aEDeEyBwAAsu X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In some bad situation, the gts may be freed gru_check_chiplet_assignment. The call chain can be gru_unload_context->gru_free_gru_context->gts_drop and kfree finally. However, the caller didn't know if the gts is freed or not and use it afterwards. This will trigger a Use after Free bug. Fix it by introducing a return value to see if it's in error path or not. Free the gts in caller if gru_check_chiplet_assignment check failed. Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2") Signed-off-by: Zheng Wang Acked-by: Dimitri Sivanich --- v9: - rewrite changelog and add comment in the code to make it more clear v8: - remove tested-by tag suggested by Greg v7: - fix some spelling problems suggested by Greg, change kernel test robot from reported-by tag to tested-by tag v6: - remove unused var checked by kernel test robot v5: - fix logical issue and remove unnecessary variable suggested by Dimitri Sivanich v4: - use VM_FAULT_NOPAGE as failure code in gru_fault and -EINVAL in other functions suggested by Yejian v3: - add preempt_enable and use VM_FAULT_NOPAGE as failure code suggested by Yejian v2: - commit message changes suggested by Greg v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/ --- drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++-- drivers/misc/sgi-gru/grumain.c | 22 ++++++++++++++++++---- drivers/misc/sgi-gru/grutables.h | 2 +- 3 files changed, 31 insertions(+), 7 deletions(-) diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c index d7ef61e602ed..bdd515d33225 100644 --- a/drivers/misc/sgi-gru/grufault.c +++ b/drivers/misc/sgi-gru/grufault.c @@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb) if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) goto exit; - gru_check_context_placement(gts); + ret = gru_check_context_placement(gts); + if (ret) + goto err; /* * CCH may contain stale data if ts_force_cch_reload is set. @@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb) exit: gru_unlock_gts(gts); return ret; +err: + gru_unlock_gts(gts); + gru_unload_context(gts, 1); + return -EINVAL; } /* @@ -874,7 +880,11 @@ int gru_set_context_option(unsigned long arg) } else { gts->ts_user_blade_id = req.val1; gts->ts_user_chiplet_id = req.val0; - gru_check_context_placement(gts); + if (gru_check_context_placement(gts)) { + gru_unlock_gts(gts); + gru_unload_context(gts, 1); + return -EINVAL; + } } break; case sco_gseg_owner: diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c index 6706ef3c5977..816def778078 100644 --- a/drivers/misc/sgi-gru/grumain.c +++ b/drivers/misc/sgi-gru/grumain.c @@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru, * chiplet. Misassignment can occur if the process migrates to a different * blade or if the user changes the selected blade/chiplet. */ -void gru_check_context_placement(struct gru_thread_state *gts) +int gru_check_context_placement(struct gru_thread_state *gts) { struct gru_state *gru; + int ret = 0; /* * If the current task is the context owner, verify that the @@ -726,15 +727,23 @@ void gru_check_context_placement(struct gru_thread_state *gts) * references. Pthread apps use non-owner references to the CBRs. */ gru = gts->ts_gru; + /* + * If gru or gts->ts_tgid_owner isn't initialized properly, return + * success is fine, for it's not a deadly error. The related variable + * can be reconfigure in other function.The caller is responsible + * for their inspection, and reinitialization if needed. + */ if (!gru || gts->ts_tgid_owner != current->tgid) - return; + return ret; if (!gru_check_chiplet_assignment(gru, gts)) { STAT(check_context_unload); - gru_unload_context(gts, 1); + ret = -EINVAL; } else if (gru_retarget_intr(gts)) { STAT(check_context_retarget_intr); } + + return ret; } @@ -934,7 +943,12 @@ vm_fault_t gru_fault(struct vm_fault *vmf) mutex_lock(>s->ts_ctxlock); preempt_disable(); - gru_check_context_placement(gts); + if (gru_check_context_placement(gts)) { + preempt_enable(); + mutex_unlock(>s->ts_ctxlock); + gru_unload_context(gts, 1); + return VM_FAULT_NOPAGE; + } if (!gts->ts_gru) { STAT(load_user_context); diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h index 8c52776db234..640daf1994df 100644 --- a/drivers/misc/sgi-gru/grutables.h +++ b/drivers/misc/sgi-gru/grutables.h @@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg); extern int gru_user_unload_context(unsigned long arg); extern int gru_get_exception_detail(unsigned long arg); extern int gru_set_context_option(unsigned long address); -extern void gru_check_context_placement(struct gru_thread_state *gts); +extern int gru_check_context_placement(struct gru_thread_state *gts); extern int gru_cpu_fault_map_id(void); extern struct vm_area_struct *gru_find_vma(unsigned long vaddr); extern void gru_flush_all_tlb(struct gru_state *gru); -- 2.25.1