linux-kernel - Re: [PATCH v3 00/34] iommu: Move iommu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Jul 2020 11:53:07 +0100
From:   Robin Murphy <robin.murphy@....com>
To:     Qian Cai <cai@....pw>, Joerg Roedel <joro@...tes.org>
Cc:     Heiko Stuebner <heiko@...ech.de>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        linux-tegra@...r.kernel.org,
        Thierry Reding <thierry.reding@...il.com>,
        Daniel Drake <drake@...lessm.com>,
        Will Deacon <will@...nel.org>,
        Jean-Philippe Brucker <jean-philippe@...aro.org>,
        linux-samsung-soc@...r.kernel.org,
        iommu@...ts.linux-foundation.org,
        Krzysztof Kozlowski <krzk@...nel.org>,
        Jonathan Hunter <jonathanh@...dia.com>,
        linux-rockchip@...ts.infradead.org, Andy Gross <agross@...nel.org>,
        jonathan.derrick@...el.com, linux-s390@...r.kernel.org,
        linux-arm-msm@...r.kernel.org, linux-mediatek@...ts.infradead.org,
        Matthias Brugger <matthias.bgg@...il.com>,
        virtualization@...ts.linux-foundation.org,
        Gerald Schaefer <gerald.schaefer@...ibm.com>,
        David Woodhouse <dwmw2@...radead.org>,
        linux-kernel@...r.kernel.org, Kukjin Kim <kgene@...nel.org>
Subject: Re: [PATCH v3 00/34] iommu: Move iommu_group setup to IOMMU core code

On 2020-07-01 01:40, Qian Cai wrote:
> Looks like this patchset introduced an use-after-free on arm-smmu-v3.
> 
> Reproduced using mlx5,
> 
> # echo 1 > /sys/class/net/enp11s0f1np1/device/sriov_numvfs
> # echo 0 > /sys/class/net/enp11s0f1np1/device/sriov_numvfs
> 
> The .config,
> https://github.com/cailca/linux-mm/blob/master/arm64.config
> 
> Looking at the free stack,
> 
> iommu_release_device->iommu_group_remove_device
> 
> was introduced in 07/34 ("iommu: Add probe_device() and release_device()
> call-backs").

Right, iommu_group_remove_device can tear down the group and call 
->domain_free before the driver has any knowledge of the last device 
going away via the ->release_device call.

I guess the question is do we simply flip the call order in 
iommu_release_device() so drivers can easily clean up their internal 
per-device state first, or do we now want them to be robust against 
freeing domains with devices still nominally attached?

Robin.