Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   "Yu, Fenghua" <fenghua.yu@intel.com>
To:     "Chatre, Reinette" <reinette.chatre@intel.com>,
        "Jiang, Dave" <dave.jiang@intel.com>,
        "vkoul@kernel.org" <vkoul@kernel.org>,
        "dmaengine@vger.kernel.org" <dmaengine@vger.kernel.org>
CC:     "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: RE: [PATCH 2/3] dmaengine: idxd: Prevent use after free on completion
 memory
Thread-Topic: [PATCH 2/3] dmaengine: idxd: Prevent use after free on
 completion memory
Thread-Index: AQHZBntzxBtxN/azOUOXL9lNk2N93q5a//JA
Date:   Fri, 2 Dec 2022 19:45:14 +0000
Message-ID: <IA1PR11MB60973AA139D6BE79958675ED9B179@IA1PR11MB6097.namprd11.prod.outlook.com>
References: <cover.1670005163.git.reinette.chatre@intel.com>
 <96e5bcd4b97445227837c3a73e1a1abd93d26175.1670005163.git.reinette.chatre@intel.com>
In-Reply-To: <96e5bcd4b97445227837c3a73e1a1abd93d26175.1670005163.git.reinette.chatre@intel.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ND5Qi2QGVuWtJz29rJDHSkP4KjfmkzTLSydBYfcRnnKmS+7EK+8LPibqDLtP?=
 =?us-ascii?Q?knk4Evb4BWQjTv8qasZSfHKYmplAmfnTfoDzlKskW35gtC+GSBs2M/WUOAg8?=
 =?us-ascii?Q?+dzlgGgWChMcPWkVeeyWb82xOS6yWtvWTpuXpMtgvxXUEVVcsg53LwwPEFIZ?=
 =?us-ascii?Q?UbVxnrOSM2is1ZMemf9kxm02h1cPokQNga4JdY5r2PsRkFzuNeb2bCg8NDdY?=
 =?us-ascii?Q?6Rh1v135jfAv+3ksw1V9LQzJ4wP26ir1HU6w3eu2ZyvvdzW0pTyCI3rPfdL2?=
 =?us-ascii?Q?9a6TYNE8yU56EboCHAaaewShdb4XL8w+1xQSvAFJcK1vkZpbuMHPRzWy6lxc?=
 =?us-ascii?Q?K/fBsANeioDmZbWfhQqk7M6qVyKkXuDz6vDi0tSmcmMP62pmpug8feuBQxwc?=
 =?us-ascii?Q?R3FsNU61/psYA06DYg/8TMN5IQ7aEOy6GiEwQ+vgfnAWs5aV+OEUUsAqPCRx?=
 =?us-ascii?Q?SlJ0+v5takZKu2/jA5l025XO/QSvngZZvHGGjG6GNOA0xw7yH/4yKK0lc3GC?=
 =?us-ascii?Q?GH/l6YXrQ2yaKh9+tShxLd1nlBNxsEllhU99fF4KjvjP7p5zuxOOHGkYzoMU?=
 =?us-ascii?Q?Ak1xLuoJvPFB34rD9WHv1Yx4KmiCkJI/jeBoM9QelgPcefk4swFH9cKwWv34?=
 =?us-ascii?Q?KQKMlzN0uBwJ6NEAFoUAs1u6gUE4I7oNQs1QXXhzFrzR5qlOsCyCkp6ClXkI?=
 =?us-ascii?Q?7frTHghR3cHYhrs4VYOk2iTs4Oe3fTnI/FCPewKIb1H7Hj9mD1tjm4vZojX6?=
 =?us-ascii?Q?wD5mP3+C9yElfYx6UEJJCVErUGE4zy0qhl99/RI4FJ/TioAHT/hsf71bnVYg?=
 =?us-ascii?Q?ICApHnqzrekk8yl1cBFuoh90+4SnSD91okjQc1fy8k0gfFWnXlrkpgVw8C3G?=
 =?us-ascii?Q?xXW2hudmLiGzUGno1xYiUMrFmZD+B7c1F9H88smMb71KzSugvOFAavq+Ti4H?=
 =?us-ascii?Q?fUCU8pkB9UghV1FbIG5OYDZJ0Agm6qpIQd9iWQNaPjazR5MU+zbrMCI30IoM?=
 =?us-ascii?Q?zRUjdfEKTk7u55BB3ENG1rvjfwHUPxDQMjw9IXBmwqGYyM1Z4c6ebGW7//i1?=
 =?us-ascii?Q?t9XMqOBI+nTiZ2ve5XONEiQD8W3lHzCkT/MDivr4+GJ/nMVwhCSpuUDkftRC?=
 =?us-ascii?Q?UxhSza6W9jPuHJ/iNcJKjVX2eFJgaJqyEOnf81YQGoNmZ8kWNPQJyX6BtOx+?=
 =?us-ascii?Q?zCHAlefp4VbZt99vunXNsXzuk+qdZvdN7erVBNh+f+lVnzVFi0vajbu50k9y?=
 =?us-ascii?Q?oNn6aUednM8YlcHBQs8U1fbZxurkDapuvo1Yf/licwf2tZTShPjuGkI+tWfX?=
 =?us-ascii?Q?YEk6kg2qPjzcXrA7TZbVzM78W3wSAIJuuZvso7IMJ7LyacSAfpqd8Ejl0r1B?=
 =?us-ascii?Q?kxO3vJmZcrwBKolXAUnKatuLLc/0bLEF9UjsVKAi4j0baK3E68fiLogCIOPs?=
 =?us-ascii?Q?Bw5RBCJwy32bmXZeTjEi0X34CyggRlQH5kMqlsfabe+VFD2C6dyjDPNKMKIS?=
 =?us-ascii?Q?MC6YbaeAM/gO3rs7PKRj9MnOVsa3VkrJkA1dPlJzbiYjzdgzTcrfxdRe47Sb?=
 =?us-ascii?Q?AX/7ndSNfJsPvd+Ap50WQhn9EPuR8ANY+3U+QqOW?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: IA1PR11MB6097.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9f0a44ba-1dc2-4513-394e-08dad49dbb94
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Dec 2022 19:45:14.7885
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 82jtOjKiHi4s7DwItZZJe0vIdTqHjqeZXWmEctlikmDB43ASGNngITdZjLYgP27XCH9nUmN08ApJPOL3AQt9Pw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR11MB7889
X-OriginatorOrg: intel.com
X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,
        SPF_HELO_NONE,SPF_NONE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

> On driver unload any pending descriptors are flushed at the time the inte=
rrupt is
> freed:
> idxd_dmaengine_drv_remove() ->
> 	drv_disable_wq() ->
> 		idxd_wq_free_irq() ->
> 			idxd_flush_pending_descs().
>=20
> If there are any descriptors present that need to be flushed this flow tr=
iggers a
> "not present" page fault as below:
>=20
>  BUG: unable to handle page fault for address: ff391c97c70c9040
>  #PF: supervisor read access in kernel mode
>  #PF: error_code(0x0000) - not-present page
>=20
> The address that triggers the fault is the address of the descriptor that=
 was freed
> moments earlier via:
> drv_disable_wq()->idxd_wq_free_resources()
>=20
> Fix the use after free by freeing the descriptors after any possible usag=
e. This is
...
> Fixes: 63c14ae6c161 ("dmaengine: idxd: refactor wq driver enable/disable
> operations")
> Suggested-by: Dave Jiang <dave.jiang@intel.com>
> Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>

Reviewed-by: Fenghua Yu <fenghua.yu@intel.com>