Received-SPF: pass (google.com: domain of linux-kernel+bounces-142050-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <40ac02bb-efe2-4f52-a4f2-7b56d9b93d2c@amd.com>
Date: Fri, 12 Apr 2024 08:39:14 +0200
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] dmabuf: fix dmabuf file poll uaf issue
To: zhiguojiang <justinjiang@vivo.com>, "T.J. Mercier" <tjmercier@google.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>, linux-media@vger.kernel.org,
 dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org,
 linux-kernel@vger.kernel.org, opensource.kernel@vivo.com
References: <20240327022903.776-1-justinjiang@vivo.com>
 <5cf29162-a29d-4af7-b68e-aac5c862d20e@amd.com>
 <cc7defae-60c1-4cc8-aee5-475d4460e574@vivo.com>
 <23375ba8-9558-4886-9c65-af9fe8e8e8b6@amd.com>
 <CABdmKX2Kf4ZmVzv3LGTz2GyP-9+rAtFY9hSAxdkrwK8mG0gDvQ@mail.gmail.com>
 <e55cad9b-a361-4d27-a351-f6a4f5b8b734@vivo.com>
Content-Language: en-US
From: =?UTF-8?Q?Christian_K=C3=B6nig?= <christian.koenig@amd.com>
In-Reply-To: <e55cad9b-a361-4d27-a351-f6a4f5b8b734@vivo.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?aVp4b1VsejlpYlZWUEJ6bW53aUo0clpTeVhGclpEOEZnY08yRlVxQ2FRWC9w?=
 =?utf-8?B?MVpjYU9BMGVyVDcyd1RsQTBwbG1OMm1WTEQ2SnNKNisxdWJNdFM1WHFlTk9D?=
 =?utf-8?B?NHVoeFR5SzZNREVmcm9LY0RkY3ZJQnd0SGh6WWZCVGJaYjZ1cFVucWtrUDlu?=
 =?utf-8?B?Z1E0blo3cDdtSGtIbjFSNWt4aGhRNER5MVpEMlJaYTY5SzR6Ulc0WDl1L2Mw?=
 =?utf-8?B?U2ozUEVOSVNQOFdBaXVFeVR6SUpTUUJ4QitlSzQvMU9kSW41c2RKK3NmMisv?=
 =?utf-8?B?MWZXYlRRaFZ4dnloQndGZ0piRWZDdnFPdGhMSFora1V1YXdYUWppR2RzSFB3?=
 =?utf-8?B?NjU4S093TldncFZwVkgxRGR6VkpqQjNLN2Npa2szWlI3VzFlV3R2UDV0czdr?=
 =?utf-8?B?OEJiZGNPaWF2VVdZOUIwdFJLemZia1Rpd2IyVnlmWFVPL2llL3ZXRDU0Qysv?=
 =?utf-8?B?eVVkWHlSaGkwdEdsZzRDaHZTVHlyUWpFYUEvelZieFp3SVJqaVNWQUxuS2t1?=
 =?utf-8?B?NmhwckNCdHhGNXZqT0ppbS8vdmJpZlBDMEFlbVVzYzJYUmJSRU9OREoxUkJD?=
 =?utf-8?B?eTVzS2xKVlpzL3RsNlV6a0FxaXVkaGxweHJMRHI1akJRYzFzeC9acVQ2OUM3?=
 =?utf-8?B?WFJZWXJvUGZTbnJ2TEs0UzE3U1lDMjlOcEd4WWs4b2VQTTh6eUhwS3UyQi9B?=
 =?utf-8?B?bmVNRHFNM3RiOU93dzVPM1AxNVlFbTNYNGdlS1dZZkZvMitkWVZiL2RCZjUz?=
 =?utf-8?B?L2lwZ0piSkVsRXJYYVhyRi96cEJJbGRhcXoxdTZUZi9iVFlyUWkrVWpBcDJx?=
 =?utf-8?B?Z2ZVVURpaUZlNFpsMjk4T2NDVE9ETUg4WTNWa1V2UHhCdWtyb2VQYmt5eUJR?=
 =?utf-8?B?YzlCdWpuUnlZaWFaSFZwVlJ4UDdQRGdteDBhR3dYQ1NRTmZub0FWdDV3QkNR?=
 =?utf-8?B?MUgyTW9UaDhLRlJNbW1hZTFVWW82MHJjY1E0NVEzZzl1VHIxWFlXUmp3MENu?=
 =?utf-8?B?SGVkbStNRmNRU05HR1doVG9TREwyeWxrTGt5TGFYYml6dXdoN3BjRmFUTWFv?=
 =?utf-8?B?d0NWNnZKMHpRRXlCNUt1allPZGxqM2ZFVkhNdURYcnhIa0NjT1ppVmJLeTNa?=
 =?utf-8?B?K2tYZ1pTblhCUDluRUUweVZNOHJQbis0ZVR2bm12QTFVM1dUWHBydzhpWVM1?=
 =?utf-8?B?Q0dESXpTUjI3ZUJqYS92em95SS9BeUVTdjZmSk5MajVXRElET2hRTFkrMnQz?=
 =?utf-8?B?WUN5TDkxNFNsNVlVUG5rTUxzVmJ6RXlIcjRSTkJPUTExbE1uTGNJKzFqeUJP?=
 =?utf-8?B?NXJvcjFyWkhmWEJSbzlsTkxxK0huV1VkZ0tUZ1AwVXdTMDhPMDZ0Vnh1azd2?=
 =?utf-8?B?UXNFQitTWkd6UVhpazE0aVQydktYV1RwMlJoMnNGVEtKSTRRK2xUR1g3VS9h?=
 =?utf-8?B?SWhGRjRsVWt2NEU3TjFHTy94NXRXSHFNb291ZFYvd2ZtV2ppOUhZaEN2YVdu?=
 =?utf-8?B?UnRUTG9jZDcrcGY3NllnY09JRmhDN09kUFdkcmxEendoQkY0TEJESDE5a1Zi?=
 =?utf-8?B?WFZPZFZqUGpEa3VVUkQ2cFVMUVl5MXpRQTVtTFd2cVNxNFd0a0lmVUp3MnBj?=
 =?utf-8?B?dWpQTUx0OSt5TTJ1Zmd4djdpNk5BVkZiZkc4dG81QzA5K0sxN2Fnc2s1RkVh?=
 =?utf-8?B?NVlWS2JYOFBjWGpPVFVsVU9vb2VmdHltQnoyUm9QN0Z5UVlOUEE0UzUxZEZh?=
 =?utf-8?B?TkNtZVM0SGFFVGRVMDE3alIyYzB0TWZ1RXpHUC9nN083TTNhNFd6ZzQ5dk5W?=
 =?utf-8?B?L01uTmR0ZjJoZWJqOFIyakRvQytKVVBTUEorVmx3aS8rZFAvdGVNZXVuQUdD?=
 =?utf-8?B?azRhK0NyMmZtaHBHdzFQeXB5NjNWQWhUOFV0UFVBTjdhb2J2VGkrd2ZsZ0g5?=
 =?utf-8?B?VWtkbW9aQ3JBQlZ6anFUR0xtS2h1Z1M2YlhIekNVUHZhVWdYM3RwMW5kS2R0?=
 =?utf-8?B?WFRIN2JzaUNOMFQxM0xjcTlNZjJPR1Z2MUFrQ0VyL0h0aXROZUxINjlFRVR6?=
 =?utf-8?B?ZjV0SEs2bEloTUY3WlMyOGhmWUl2T3lnQmRHdUlQWXViRW10QmxXeExaRks0?=
 =?utf-8?Q?6UPmyibxZBD79eNjH6yRf7Npl?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 58460528-97d9-47a6-48e3-08dc5abb48c1
X-MS-Exchange-CrossTenant-AuthSource: PH7PR12MB5685.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Apr 2024 06:39:20.8113
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: YQz4in2mgetj+TXos2DJN5peSxWrOwX/uujZk3CFMwITd7SmF6J5fw6uptyU1StM
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA1PR12MB6774

Am 12.04.24 um 08:19 schrieb zhiguojiang:
> [SNIP]
> -> Here task 2220 do epoll again where internally it will get/put then 
> start to free twice and lead to final crash.
>
> Here is the basic flow:
>
> 1. Thread A install the dma_buf_fd via dma_buf_export, the fd refcount 
> is 1
>
> 2. Thread A add the fd to epoll list via epoll_ctl(EPOLL_CTL_ADD)
>
> 3. After use the dma buf, Thread A close the fd, then here fd refcount 
> is 0,
>   and it will run __fput finally to release the file

Stop, that isn't correct.

The fs layer which calls dma_buf_poll() should make sure that the file 
can't go away until the function returns.

Then inside dma_buf_poll() we add another reference to the file while 
installing the callback:

                         /* Paired with fput in dma_buf_poll_cb */
                         get_file(dmabuf->file);

This reference is only dropped after the callback is completed in 
dma_buf_poll_cb():

         /* Paired with get_file in dma_buf_poll */
         fput(dmabuf->file);

So your explanation for the issue just seems to be incorrect.

>
> 4. Here Thread A not do epoll_ctl(EPOLL_CTL_DEL) manunally, so it 
> still resides in one epoll_list.
>   Although __fput will call eventpoll_release to remove the file from 
> binded epoll list,
>   but it has small time window where Thread B jumps in.

Well if that is really the case then that would then be a bug in 
epoll_ctl().

>
> 5. During the small window, Thread B do the poll action for 
> dma_buf_fd, where it will fget/fput for the file,
>   this means the fd refcount will be 0 -> 1 -> 0, and it will call 
> __fput again.
>   This will lead to __fput twice for the same file.
>
> 6. So the potenial fix is use get_file_rcu which to check if file 
> refcount already zero which means under free.
>   If so, we just return and no need to do the dma_buf_poll.

Well to say it bluntly as far as I can see this suggestion is completely 
nonsense.

When the reference to the file goes away while dma_buf_poll() is 
executed then that's a massive bug in the caller of that function.

Regards,
Christian.

>
> Here is the race condition:
>
> Thread A Thread B
> dma_buf_export
> fd_refcount is 1
> epoll_ctl(EPOLL_ADD)
> add dma_buf_fd to epoll list
> close(dma_buf_fd)
> fd_refcount is 0
> __fput
> dma_buf_poll
> fget
> fput
> fd_refcount is zero again
>
> Thanks
>