linux-kernel - Re: [PATCH v2 1/4] powerpc/kvm/book3s: Fixes possible 'use after release' of kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b8f93386fe124d2328b6f393845a3435fd3b94fa.camel@linux.ibm.com>
Date:   Thu, 21 Nov 2019 10:24:08 -0300
From:   Leonardo Bras <leonardo@...ux.ibm.com>
To:     Michael Ellerman <mpe@...erman.id.au>, kvm-ppc@...r.kernel.org,
        linuxppc-dev@...ts.ozlabs.org, linux-kernel@...r.kernel.org
Cc:     Paul Mackerras <paulus@...abs.org>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>
Subject: Re: [PATCH v2 1/4] powerpc/kvm/book3s: Fixes possible 'use after
 release' of kvm

On Thu, 2019-11-14 at 15:43 -0300, Leonardo Bras wrote:
> > If the kvm_put_kvm() you've moved actually caused the last
> > reference
> > to
> > be dropped that would mean that our caller had passed us a kvm
> > struct
> > without holding a reference to it, and that would be a bug in our
> > caller.
> > 
> 
> So, there is no chance that between this function's kvm_get_kvm()
> and 
> kvm_put_kvm(), another thread can decrease this reference counter?

I am probably missing something here, could you please help me
understand that?

> > Or put another way, it would mean the mutex_lock() above could
> > already
> > be operating on a freed kvm struct.
> > 
> > The kvm_get_kvm() prior to the anon_inode_getfd() is to account for
> > the
> > reference that's held by the `stt` struct, and dropped in
> > kvm_spapr_tce_release().
> > 
> > So although this patch isn't wrong, the explanation is not
> > accurate.
> > 
> > cheers
> 
> Kind regards

Best regards,

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)