Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
Message-ID: <8f7418e3-816f-4bfd-bf6e-8be68054f55d@oracle.com>
Date:   Wed, 25 Oct 2023 23:55:22 -0700
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] vhost-vdpa: fix use-after-free in _compat_vdpa_reset
Content-Language: en-US
To:     "Michael S. Tsirkin" <mst@redhat.com>
Cc:     jasowang@redhat.com, virtualization@lists.linux-foundation.org,
        sfr@canb.auug.org.au, leiyang@redhat.com,
        linux-kernel@vger.kernel.org, linux-next@vger.kernel.org
References: <1698275594-19204-1-git-send-email-si-wei.liu@oracle.com>
 <20231026012326-mutt-send-email-mst@kernel.org>
From:   Si-Wei Liu <si-wei.liu@oracle.com>
Organization: Oracle Corporation
In-Reply-To: <20231026012326-mutt-send-email-mst@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VVU5S3c2MXBMaFVpMURzcEFtajRkSVpUNW9QaHkvYXpCUEJ0dGVrTmF6dm1X?=
 =?utf-8?B?S1lVTlV3eWZnOFl2bGpiRDdST09rTGk1MWdEUTR2OTBGVm12OThVcEpCcERa?=
 =?utf-8?B?N2xkbnNxMWZsWmFDKzRaV3ZUM2o0QlJVT1E2N0xhbm1MdkkwbHJVYlpjckdz?=
 =?utf-8?B?L2kxZnpxREVWd0NPMUVvK1Rzd0MrODZabkFWMHdidXY2bThqU2VWWEtHelVW?=
 =?utf-8?B?WVpzSml0NnhoT3MzTUFuUUlweGs2aXp2VTBOSFVqcG1TRTFQSHhkb3B1dUR3?=
 =?utf-8?B?Y0poMU5mZkd3SVpRVklmM1UrZWtSaWRCTm4yNGpNRDBPbE1veXQwUGMvTVRY?=
 =?utf-8?B?VWN4Y1NIUjZFL0RNYzVTcXZWVmdjZkhET2VRSm5rQWVLZ24zemFJWndQSWJN?=
 =?utf-8?B?THlEWENUTjZKKzh5ZDcxb01CckMzWGpoQzJqd1FvQmJkZ2U2eU5nQXZrVzlv?=
 =?utf-8?B?aXFKZGVsTUNSNVYwNmZqSFVYWnlwalpiMjgzQjlTb1VXUUlIYzM5M3hGUits?=
 =?utf-8?B?NW9qakxDZzBiU2VQUjVmbm1xcXphUkNyTjdMQXdCeHF1WFA5QS9kbWZ4RUNY?=
 =?utf-8?B?RHhSZHNHN0xOMkUxOUlIdnNmdjMybnVVZCtJT05QYlhqd3hrZlppTlUzQnpX?=
 =?utf-8?B?anBST2FEREs1TkZaYlNobVAxcXd4N0hBcExrYm9ndzRyWUE3VjNZOVlxTHpR?=
 =?utf-8?B?MVZXZmNYRzVvMFZJZm5ySytHdGd2WHhsNlZlMWNGdHBVRzVOZStySVNPZUlW?=
 =?utf-8?B?bzdhZWtJNjlmSmZsQjFCY0FYRFhIMjhmYUYxMFNLNW1QYWJQNHpub3d0d0sr?=
 =?utf-8?B?QUFhNHFaR1k2QS9EUk9BR0dKZUdCUC9LRldWS2hnWFl4enFVZnR2MkZkcFNi?=
 =?utf-8?B?TThGd1hKbjlsWEhuMGJEV1NhS1pZU3plVGJjbHg3dXYxZFVaNEl1YkwzRTRr?=
 =?utf-8?B?S3Y2S0FvY1VWU2FQWWJ0emdRU05LeHNPVUUzUG80enZvQWVQNk45ZmNQY3Jo?=
 =?utf-8?B?VTR5bnlFUXd1V3dOMlFJSTE5SHpQTXdGdmZ3Tlg1T1ZkV1dHdHJqMTNrNGZo?=
 =?utf-8?B?UUVxaWRMdWJzNjRya212aTlmRjVSQlpPREVyd2s2ZEhPVlpOc0dQKzJVazVq?=
 =?utf-8?B?N3VRWWk0L0h2SWRVRFpaWWN5SDdrWW03L29WTmtiQTlsZVZHVnR0NHBzUFo3?=
 =?utf-8?B?MHBiYWhTSURhL2NKR2RLRjdHRUxjVmpUVVppQnJMcC9hS25ES2Q0RktweFJa?=
 =?utf-8?B?OExKckxyKzNXSW5pTWN6T0NJdWVKaCtIcERpQ25xb3Y5UlM2REFIWEgxSmVE?=
 =?utf-8?B?TzUwOVhOeWo1ZHE2ZHphendyUW1HYWJzK3EzVVVYL292bnNJSHE1aGhQb0RK?=
 =?utf-8?B?Q3d6YkhaRkJEYmptSTdGSFF4TzB2WE9yMWQ1MDRPQVdQV3lBVEQ2VlJUUGZ0?=
 =?utf-8?B?M3ZWa2IzZXFoSzRKQ0JTVTJMOXU5NkNRNVRORHUzclRWYlVuaGRNN2VmWU96?=
 =?utf-8?B?NFpJb1ZGbUxkbHdkWm9HTFM1dnNjZlNMb0R0cXhHdk9zeWlFM2xIMHJLZ3JX?=
 =?utf-8?B?VkhyMnJwUDZTZ2NyV0tTRWRjTC9xd0pVakcxa09nS3d1SU0vaVk4WHdLeTdj?=
 =?utf-8?B?ZkxMODZaR2JUN0hROVhySnNMcEVuTUNSd3N3WWNLV3NhN1ZUdTRuMlNYdUs2?=
 =?utf-8?B?Mk5ndHBDVjBHZzVGSWVPNGxJQi95NjQ2WjhKUlFhZ0FyNkJpT0s2am5TTTk3?=
 =?utf-8?B?KzlhWWVhTXpsL0x0ck52OEw2eEo5ZnRUQkNaSDFLUnZPRnRVN05hNGJMYytM?=
 =?utf-8?B?V1dET04rQklSM3dKblNlZVRTdTVuTUNWc3dLNUR2U2l5Z1ArUHA3V1ZXaWQz?=
 =?utf-8?B?NjhaT1lxeDJaNm83d2s5U3FzMERDV2dUWFRveFBMSWZxb2g0WUg4eDJjeWZw?=
 =?utf-8?B?QUJpUWdjOGtVc2dodUdnZ1hNMkpaMktzd2NsSE5HYWtPQnZiN0Fjb1dDdWkv?=
 =?utf-8?B?cVd0WGRnUHhiSXlzcU5ubk80VkE4bG5PSkVjLy9ZeEtxQndCUldBMEhzWlE1?=
 =?utf-8?B?TGFYS0VqejNNOTBkV3FuOFJSOE9ZdFBoS21FK1dwRzhiQXU3dUo3R3lYWjR5?=
 =?utf-8?Q?KD5bk78pXb/gZytgjJRwyUhXZ?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: MvNgxLfFf5FZXxG9cBzT/H5kXahrZNImNoVGitkXTb1iEsCsPpS0yAx+q/rSzNPFcH3hQ3YnOqLA2ELuTs8t3Ok9tjC37KbqUR6xO40PyaEMI4i2HZEdXU5kn/wuh5gX/GaQDI06YpJrqluvuamFpFyN2R1vYWQOENqy3BSsazzmrSyjJGqYxOUaDXIxpeCJYHNMla2pDqWAaDBrI/ur6tcS7x3Raxur288QXiHKn+vN+3Q46uSBWZfqcbwmHIEjd4GjMVqLplFTwnfCyaIwzab9qrMggRAboC9pfh5z7pglLQAHhRxFvaSs7ozerv3ynCeB0mFExYxSWcrZelXKGsvxREfFAPXUayHHVclSDXYYdCVPrxyvZGYLF7KoKWQwv8q/Dx3+4Icl3V3rjoXxNjiXonV+4bhcatuiqmIBPitsOyQk73C88C7LU5d1xgyY4XTujC10e2Xl7GE10KJENFriltsj6PoFjje9cn2sRwOo/+x3loMPgwy30aDOn7oERr54/8Eb4no/Sc364V1i7SwlTNsRLEEefspStrCbP+l4o8KFj7vSbH3ZUX5Eg6WZ9UciRcT3mMn116BqZIvCpw3SAOC8u96g9QLsjf+3on9XkUQQN14Rs6E2hn1gkcbvynYV++kobVesVLxnLBRfnyz82Gm33OOEwF90iWT5wmXfYBmHxNeFBIKaYVxj3DB4Gg5t78Nch0+nXJJ/taTLWSXcHUnREI8w4u71TGvCA5vDJ333TikQNTBOxInjWZGW1pc+ax5+D6UI7yl0QsLCEmOziskjG2UfVLem+lFGHnpMc1uPpVGokCVVVvWfUf2spM4VUs3pK7OPiFLxEXqiZMrlB1BcTEut4SBz/VnXZOD3v5VE1jWyEIGiyXv6o71zTtieUMVLrLhiU/nahoGY1h5OFDsuKxkCRUAAb6Ont88=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 0c0a4c58-a609-4e23-3f17-08dbd5f087cb
X-MS-Exchange-CrossTenant-AuthSource: MW4PR10MB6535.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2023 06:55:25.1738
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: fSlCUVAQ+dlChe9Er6nKD8rxnQ7m2GKW5u3e/3lqTabdRdaveWXTvMCFuuImLwe04b+VtjlRGyN9aCp/fTbyfA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR10MB5705
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.272,Aquarius:18.0.980,Hydra:6.0.619,FMLib:17.11.176.26
 definitions=2023-10-26_04,2023-10-25_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 malwarescore=0 mlxscore=0
 suspectscore=0 spamscore=0 adultscore=0 mlxlogscore=999 bulkscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2310170001
 definitions=main-2310260057
X-Proofpoint-GUID: XXn8lJv6Qf0Nvl3XlzS_Mrpq2p_5wVEK
X-Proofpoint-ORIG-GUID: XXn8lJv6Qf0Nvl3XlzS_Mrpq2p_5wVEK
X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on agentk.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (agentk.vger.email [0.0.0.0]); Wed, 25 Oct 2023 23:55:52 -0700 (PDT)


On 10/25/2023 10:26 PM, Michael S. Tsirkin wrote:
> On Wed, Oct 25, 2023 at 04:13:14PM -0700, Si-Wei Liu wrote:
>> When the vhost-vdpa device is being closed, vhost_vdpa_cleanup() doesn't
>> clean up the vqs pointer after free. This could lead to use-after-tree
>> when _compat_vdpa_reset() tries to access the vqs that are freed already.
>> Fix is to set vqs pointer to NULL at the end of vhost_vdpa_cleanup()
>> after getting freed, which is guarded by atomic opened state.
>>
>>    BUG: unable to handle page fault for address: 00000001005b4af4
>>    #PF: supervisor read access in kernel mode
>>    #PF: error_code(0x0000) - not-present page
>>    PGD 16a80a067 P4D 0
>>    Oops: 0000 [#1] PREEMPT SMP NOPTI
>>    CPU: 4 PID: 40387 Comm: qemu-kvm Not tainted 6.6.0-rc7+ #3
>>    Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.8.2 09/14/2022
>>    RIP: 0010:_compat_vdpa_reset.isra.0+0x27/0xb0 [vhost_vdpa]
>>    Code: 90 90 90 0f 1f 44 00 00 41 55 4c 8d ae 08 03 00 00 41 54 55 48
>>    89 f5 53 4c 8b a6 00 03 00 00 48 85 ff 74 49 48 8b 07 4c 89 ef <48> 8b
>>    80 88 45 00 00 48 c1 e8 08 48 83 f0 01 89 c3 e8 73 5e 9b dc
>>    RSP: 0018:ff73a85762073ba0 EFLAGS: 00010286
>>    RAX: 00000001005b056c RBX: ff32b13ca6994c68 RCX: 0000000000000002
>>    RDX: 0000000000000001 RSI: ff32b13c07559000 RDI: ff32b13c07559308
>>    RBP: ff32b13c07559000 R08: 0000000000000000 R09: ff32b12ca497c0f0
>>    R10: ff73a85762073c58 R11: 0000000c106f9de3 R12: ff32b12c95b1d050
>>    R13: ff32b13c07559308 R14: ff32b12d0ddc5100 R15: 0000000000008002
>>    FS:  00007fec5b8cbf80(0000) GS:ff32b13bbfc80000(0000)
>>    knlGS:0000000000000000
>>    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>    CR2: 00000001005b4af4 CR3: 000000015644a003 CR4: 0000000000773ee0
>>    PKRU: 55555554
>>    Call Trace:
>>     <TASK>
>>     ? __die+0x20/0x70
>>     ? page_fault_oops+0x76/0x170
>>     ? exc_page_fault+0x65/0x150
>>     ? asm_exc_page_fault+0x22/0x30
>>     ? _compat_vdpa_reset.isra.0+0x27/0xb0 [vhost_vdpa]
>>     vhost_vdpa_open+0x57/0x280 [vhost_vdpa]
>>     ? __pfx_chrdev_open+0x10/0x10
>>     chrdev_open+0xc6/0x260
>>     ? __pfx_chrdev_open+0x10/0x10
>>     do_dentry_open+0x16e/0x530
>>     do_open+0x21c/0x400
>>     path_openat+0x111/0x290
>>     do_filp_open+0xb2/0x160
>>     ? __check_object_size.part.0+0x5e/0x140
>>     do_sys_openat2+0x96/0xd0
>>     __x64_sys_openat+0x53/0xa0
>>     do_syscall_64+0x59/0x90
>>     ? syscall_exit_to_user_mode+0x22/0x40
>>     ? do_syscall_64+0x69/0x90
>>     ? syscall_exit_to_user_mode+0x22/0x40
>>     ? do_syscall_64+0x69/0x90
>>     ? do_syscall_64+0x69/0x90
>>     ? syscall_exit_to_user_mode+0x22/0x40
>>     ? do_syscall_64+0x69/0x90
>>     ? exc_page_fault+0x65/0x150
>>     entry_SYSCALL_64_after_hwframe+0x6e/0xd8
>>
>> Fixes: 10cbf8dfaf93 ("vhost-vdpa: clean iotlb map during reset for older userspace")
>> Fixes: ac7e98c73c05 ("vhost-vdpa: fix NULL pointer deref in _compat_vdpa_reset")
> So these two are all in next correct?
>
> I really do not like it how 10cbf8dfaf936e3ef1f5d7fdc6e9dada268ba6bb
> introduced a regression and then apparently we keep fixing things up?
Sorry my bad. The latest one should be all of it.

>
> Can I squash these 3 commits?
Sure. Or if you want me to send a v5 with all 3 commits squashed in, I 
can do for sure.

Thanks,
-Siwei
>
>
>> Reported-by: Lei Yang <leiyang@redhat.com>
>> Closes: https://lore.kernel.org/all/CAPpAL=yHDqn1AztEcN3MpS8o4M+BL_HVy02FdpiHN7DWd91HwQ@mail.gmail.com/
>> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
>> ---
>>   drivers/vhost/vdpa.c | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
>> index 9a2343c45df0..30df5c58db73 100644
>> --- a/drivers/vhost/vdpa.c
>> +++ b/drivers/vhost/vdpa.c
>> @@ -1355,6 +1355,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)
>>   	vhost_vdpa_free_domain(v);
>>   	vhost_dev_cleanup(&v->vdev);
>>   	kfree(v->vdev.vqs);
>> +	v->vdev.vqs = NULL;
>>   }
>>   
>>   static int vhost_vdpa_open(struct inode *inode, struct file *filep)
>> -- 
>> 2.39.3