[v5] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
Commit Message
Gts may be freed in gru_check_chiplet_assignment.
The caller still use it after that, UAF happens.
Fix it by introducing a return value to see if it's in error path or not.
Free the gts in caller if gru_check_chiplet_assignment check failed.
Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2")
Reported-by: Zheng Wang <hackerzheng666@gmail.com>
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
v5:
- fix logical issue and remove unnecessary variable suggested by Dimitri Sivanich
v4:
- use VM_FAULT_NOPAGE as failure code in gru_fault and -EINVAL in other functions suggested by Yejian
v3:
- add preempt_enable and use VM_FAULT_NOPAGE as failure code suggested by Yejian
v2:
- commit message changes suggested by Greg
v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/
---
drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++--
drivers/misc/sgi-gru/grumain.c | 17 +++++++++++++----
drivers/misc/sgi-gru/grutables.h | 2 +-
3 files changed, 26 insertions(+), 7 deletions(-)
Comments
Hi Zheng,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on char-misc/char-misc-testing]
[also build test WARNING on linus/master v6.1-rc2 next-20221026]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/misc-sgi-gru-fix-use-after-free-error-in-gru_set_context_option-gru_fault-and-gru_handle_user_call_os/20221027-120633
patch link: https://lore.kernel.org/r/20221027040455.115035-1-zyytlz.wz%40163.com
patch subject: [PATCH v5] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
config: x86_64-allyesconfig
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/c93eb9fc5a22e105d7ebb1a23fe110262c95a177
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Zheng-Wang/misc-sgi-gru-fix-use-after-free-error-in-gru_set_context_option-gru_fault-and-gru_handle_user_call_os/20221027-120633
git checkout c93eb9fc5a22e105d7ebb1a23fe110262c95a177
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/misc/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
drivers/misc/sgi-gru/grumain.c: In function 'gru_fault':
>> drivers/misc/sgi-gru/grumain.c:925:13: warning: unused variable 'ret' [-Wunused-variable]
925 | int ret;
| ^~~
vim +/ret +925 drivers/misc/sgi-gru/grumain.c
911
912 /*
913 * gru_nopage
914 *
915 * Map the user's GRU segment
916 *
917 * Note: gru segments alway mmaped on GRU_GSEG_PAGESIZE boundaries.
918 */
919 vm_fault_t gru_fault(struct vm_fault *vmf)
920 {
921 struct vm_area_struct *vma = vmf->vma;
922 struct gru_thread_state *gts;
923 unsigned long paddr, vaddr;
924 unsigned long expires;
> 925 int ret;
926
927 vaddr = vmf->address;
928 gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
929 vma, vaddr, GSEG_BASE(vaddr));
930 STAT(nopfn);
931
932 /* The following check ensures vaddr is a valid address in the VMA */
933 gts = gru_find_thread_state(vma, TSID(vaddr, vma));
934 if (!gts)
935 return VM_FAULT_SIGBUS;
936
937 again:
938 mutex_lock(>s->ts_ctxlock);
939 preempt_disable();
940
941 if (gru_check_context_placement(gts)) {
942 preempt_enable();
943 mutex_unlock(>s->ts_ctxlock);
944 gru_unload_context(gts, 1);
945 return VM_FAULT_NOPAGE;
946 }
947
948 if (!gts->ts_gru) {
949 STAT(load_user_context);
950 if (!gru_assign_gru_context(gts)) {
951 preempt_enable();
952 mutex_unlock(>s->ts_ctxlock);
953 set_current_state(TASK_INTERRUPTIBLE);
954 schedule_timeout(GRU_ASSIGN_DELAY); /* true hack ZZZ */
955 expires = gts->ts_steal_jiffies + GRU_STEAL_DELAY;
956 if (time_before(expires, jiffies))
957 gru_steal_context(gts);
958 goto again;
959 }
960 gru_load_context(gts);
961 paddr = gseg_physical_address(gts->ts_gru, gts->ts_ctxnum);
962 remap_pfn_range(vma, vaddr & ~(GRU_GSEG_PAGESIZE - 1),
963 paddr >> PAGE_SHIFT, GRU_GSEG_PAGESIZE,
964 vma->vm_page_prot);
965 }
966
967 preempt_enable();
968 mutex_unlock(>s->ts_ctxlock);
969
970 return VM_FAULT_NOPAGE;
971 }
972
@@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb)
if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
goto exit;
- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
+ if (ret)
+ goto err;
/*
* CCH may contain stale data if ts_force_cch_reload is set.
@@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb)
exit:
gru_unlock_gts(gts);
return ret;
+err:
+ gru_unlock_gts(gts);
+ gru_unload_context(gts, 1);
+ return -EINVAL;
}
/*
@@ -874,7 +880,11 @@ int gru_set_context_option(unsigned long arg)
} else {
gts->ts_user_blade_id = req.val1;
gts->ts_user_chiplet_id = req.val0;
- gru_check_context_placement(gts);
+ if (gru_check_context_placement(gts)) {
+ gru_unlock_gts(gts);
+ gru_unload_context(gts, 1);
+ return -EINVAL;
+ }
}
break;
case sco_gseg_owner:
@@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
* chiplet. Misassignment can occur if the process migrates to a different
* blade or if the user changes the selected blade/chiplet.
*/
-void gru_check_context_placement(struct gru_thread_state *gts)
+int gru_check_context_placement(struct gru_thread_state *gts)
{
struct gru_state *gru;
+ int ret = 0;
/*
* If the current task is the context owner, verify that the
@@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts)
*/
gru = gts->ts_gru;
if (!gru || gts->ts_tgid_owner != current->tgid)
- return;
+ return ret;
if (!gru_check_chiplet_assignment(gru, gts)) {
STAT(check_context_unload);
- gru_unload_context(gts, 1);
+ ret = -EINVAL;
} else if (gru_retarget_intr(gts)) {
STAT(check_context_retarget_intr);
}
+
+ return ret;
}
@@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
struct gru_thread_state *gts;
unsigned long paddr, vaddr;
unsigned long expires;
+ int ret;
vaddr = vmf->address;
gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -934,7 +938,12 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
mutex_lock(>s->ts_ctxlock);
preempt_disable();
- gru_check_context_placement(gts);
+ if (gru_check_context_placement(gts)) {
+ preempt_enable();
+ mutex_unlock(>s->ts_ctxlock);
+ gru_unload_context(gts, 1);
+ return VM_FAULT_NOPAGE;
+ }
if (!gts->ts_gru) {
STAT(load_user_context);
@@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
extern int gru_user_unload_context(unsigned long arg);
extern int gru_get_exception_detail(unsigned long arg);
extern int gru_set_context_option(unsigned long address);
-extern void gru_check_context_placement(struct gru_thread_state *gts);
+extern int gru_check_context_placement(struct gru_thread_state *gts);
extern int gru_cpu_fault_map_id(void);
extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
extern void gru_flush_all_tlb(struct gru_state *gru);