From patchwork Tue Oct 18 16:52:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zheng Wang X-Patchwork-Id: 4252 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp2059970wrs; Tue, 18 Oct 2022 09:57:56 -0700 (PDT) X-Google-Smtp-Source: AMsMyM40xqtYeLaZW/6trpjcHWZHY/ENUB9GpLg/J3igagQXLwapnGXPk5kRsrzSIs4aXr8prTex X-Received: by 2002:a17:907:9815:b0:78e:4b6:1afb with SMTP id ji21-20020a170907981500b0078e04b61afbmr3228307ejc.291.1666112276055; Tue, 18 Oct 2022 09:57:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666112276; cv=none; d=google.com; s=arc-20160816; b=h+4Eny7Q9lVM7k/trDRt3c8KEecdWoL92jCorUQHE2WPhvEFYVeXW/xI0TYEUgYnIs gstqvPnFwZfMOFAGll1NNcivBip9Oj6nyIF3cmOLPvpdJLn3cgzv+yxUsMl3QI23L/AN P5DwdX6zwkMtH8uOpz7BuAAc+syHzsUQBTqf6VljTW++F8KiOG/GcR7BU4PeA5J8PCBb 0hZB+4kyM7dtYAxgLJ2wXmL6cKA2Jbslz63OsIIe2AD97Xy68yH+A1DpmFWfIZOFnriM dRjOnt8Ucq1JFm55p3xs8ATbG9hZQqsST6lEU8zmq/VcLtvh7KOD3hYi3yO0LKai/Mwe SKTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=LfINbieI9y81fR/YR8yjekbvoW1Faa+qpXcowvV6Uuo=; b=ikkwm7OqvOWXQEkCL8jHMucSKErKi1hUwMagYbmbgEF3C268gaIF+69HOLwNZDnd5c rVn4uAlKYJIvKZqnCSQhAoxV20+QxraaO6WbH3M7R0cUOMaUD57eGaDlww6dyFuIl4ni CNGU5wXRZKjrXyukiQPzWrbOnoLffVxvuIVVV3JBaeXlBeVTaLGJhaXy7lQceLwkz7Ot aXJUSFDDi8k2SfixIkCd9+n7GXNDloeaRrxVwsdZ6J3qS6i9jY6tARfmF8JE2O8ff/pz GM6geMvi7CuognIRM3RQZCLMMAy8YGF0Y64CRjYY5y60vONiitHpFCQpOgqk1gyDqA/i JISQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=LCp9EtSn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 21-20020a170906309500b0078d4b9e68cbsi11360789ejv.1002.2022.10.18.09.57.30; Tue, 18 Oct 2022 09:57:56 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@163.com header.s=s110527 header.b=LCp9EtSn; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=163.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229930AbiJRQxf (ORCPT + 99 others); Tue, 18 Oct 2022 12:53:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40254 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229787AbiJRQxe (ORCPT ); Tue, 18 Oct 2022 12:53:34 -0400 Received: from mail-m972.mail.163.com (mail-m972.mail.163.com [123.126.97.2]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 3FC7F5FD2 for ; Tue, 18 Oct 2022 09:53:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=LfINb ieI9y81fR/YR8yjekbvoW1Faa+qpXcowvV6Uuo=; b=LCp9EtSnuNZnpeboFcpmp jYK5IgJfwe3Gep8pxIO05SLZO7fwUvAvApvKT5aJRHztlotiwqz5QKbi/XQBGi7W PVgFZHVzbSVqnaLb3n/CXzGkF02fqVkhe4Okn1I9MXWHWqttoln6rMDr+istoT0M sy4WbBK6CZoLCsuO4injbM= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by smtp2 (Coremail) with SMTP id GtxpCgAHKr_s2U5jMl8Amw--.10046S2; Wed, 19 Oct 2022 00:53:00 +0800 (CST) From: Zheng Wang To: gregkh@linuxfoundation.org Cc: dimitri.sivanich@hpe.com, arnd@arndb.de, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, alex000young@gmail.com, security@kernel.org, Zheng Wang Subject: [PATCH v3] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os Date: Wed, 19 Oct 2022 00:52:59 +0800 Message-Id: <20221018165259.693958-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CM-TRANSID: GtxpCgAHKr_s2U5jMl8Amw--.10046S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxGr4xtF4UKFy3KF1UGw4rXwb_yoWrtF4xpa 1jg348ZrW3XF4Y9rsrta1kWFW3Ca4kJFWUGr9rt34F9w4rAFs8C34DJas8tr4DZrW0qr4a yr4rtFnI9an0gaUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0ziaiiDUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXAyeU1Xl4hhhVwAAsh X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747045346250486192?= X-GMAIL-MSGID: =?utf-8?q?1747045346250486192?= Gts may be freed in gru_check_chiplet_assignment. The caller still use it after that, UAF happens. Fix it by introducing a return value to see if it's in error path or not. Free the gts in caller if gru_check_chiplet_assignment check failed. Fixes: 55484c45dbec ("gru: allow users to specify gru chiplet 2") Reported-by: Zheng Wang Signed-off-by: Zheng Wang --- v3: - add preempt_enable and use VM_FAULT_NOPAGE as failure code by Yejian v2: - commit message changes suggested by Greg v1: https://lore.kernel.org/lkml/CAJedcCzY72jqgF-pCPtx66vXXwdPn-KMagZnqrxcpWw1NxTLaA@mail.gmail.com/ --- drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++-- drivers/misc/sgi-gru/grumain.c | 18 ++++++++++++++---- drivers/misc/sgi-gru/grutables.h | 2 +- 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c index d7ef61e602ed..864be8a2cb61 100644 --- a/drivers/misc/sgi-gru/grufault.c +++ b/drivers/misc/sgi-gru/grufault.c @@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb) if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) goto exit; - gru_check_context_placement(gts); + ret = gru_check_context_placement(gts); + if (ret) + goto err; /* * CCH may contain stale data if ts_force_cch_reload is set. @@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb) exit: gru_unlock_gts(gts); return ret; +err: + gru_unlock_gts(gts); + gru_unload_context(gts, 1); + return VM_FAULT_NOPAGE; } /* @@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg) } else { gts->ts_user_blade_id = req.val1; gts->ts_user_chiplet_id = req.val0; - gru_check_context_placement(gts); + ret = gru_check_context_placement(gts); } break; case sco_gseg_owner: @@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg) ret = -EINVAL; } gru_unlock_gts(gts); + if (ret) { + gru_unload_context(gts, 1); + ret = VM_FAULT_NOPAGE; + } return ret; } diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c index 9afda47efbf2..952803790818 100644 --- a/drivers/misc/sgi-gru/grumain.c +++ b/drivers/misc/sgi-gru/grumain.c @@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru, * chiplet. Misassignment can occur if the process migrates to a different * blade or if the user changes the selected blade/chiplet. */ -void gru_check_context_placement(struct gru_thread_state *gts) +int gru_check_context_placement(struct gru_thread_state *gts) { struct gru_state *gru; + int ret = 0; /* * If the current task is the context owner, verify that the @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_state *gts) */ gru = gts->ts_gru; if (!gru || gts->ts_tgid_owner != current->tgid) - return; + return ret; if (!gru_check_chiplet_assignment(gru, gts)) { STAT(check_context_unload); - gru_unload_context(gts, 1); + ret = VM_FAULT_NOPAGE; } else if (gru_retarget_intr(gts)) { STAT(check_context_retarget_intr); } + + return ret; } @@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf) struct gru_thread_state *gts; unsigned long paddr, vaddr; unsigned long expires; + int ret; vaddr = vmf->address; gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n", @@ -934,7 +938,13 @@ vm_fault_t gru_fault(struct vm_fault *vmf) mutex_lock(>s->ts_ctxlock); preempt_disable(); - gru_check_context_placement(gts); + ret = gru_check_context_placement(gts); + if (ret) { + preempt_enable(); + mutex_unlock(>s->ts_ctxlock); + gru_unload_context(gts, 1); + return ret; + } if (!gts->ts_gru) { STAT(load_user_context); diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h index 5efc869fe59a..f4a5a787685f 100644 --- a/drivers/misc/sgi-gru/grutables.h +++ b/drivers/misc/sgi-gru/grutables.h @@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg); extern int gru_user_unload_context(unsigned long arg); extern int gru_get_exception_detail(unsigned long arg); extern int gru_set_context_option(unsigned long address); -extern void gru_check_context_placement(struct gru_thread_state *gts); +extern int gru_check_context_placement(struct gru_thread_state *gts); extern int gru_cpu_fault_map_id(void); extern struct vm_area_struct *gru_find_vma(unsigned long vaddr); extern void gru_flush_all_tlb(struct gru_state *gru);