linux-kernel - [PATCH v6 0/2] s390/vfio-ap: fix memory leak in mdev remove callback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210621155714.1198545-1-akrowiak@linux.ibm.com>
Date:   Mon, 21 Jun 2021 11:57:12 -0400
From:   Tony Krowiak <akrowiak@...ux.ibm.com>
To:     linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     borntraeger@...ibm.com, cohuck@...hat.com,
        pasic@...ux.vnet.ibm.com, jjherne@...ux.ibm.com, jgg@...dia.com,
        alex.williamson@...hat.com, kwankhede@...dia.com,
        frankja@...ux.ibm.com, david@...hat.com, imbrenda@...ux.ibm.com,
        hca@...ux.ibm.com
Subject: [PATCH v6 0/2] s390/vfio-ap: fix memory leak in mdev remove callback

The mdev remove callback for the vfio_ap device driver bails out with
-EBUSY if the mdev is in use by a KVM guest. The intended purpose was
to prevent the mdev from being removed while in use; however, returning a
non-zero rc does not prevent removal of the mdev. Consequently, the memory
for the resources allocated when the mdev was created are leaked. 

To fix this issue:

* The remove callback will not terminate with -EBUSY when the mdev is in
  use by a KVM guest.
  
* The memory for the resources allocated when the mdev was created will
  be freed.
  
* Since the struct ap_matrix_mdev now gets freed while the guest is
  is still running, we need to ensure that the pointer to the function
  that handles interception of the PQAP instruction executed on the guest
  is not accessed while it is being set to NULL. To prevent this, a r/w
  lock is introduced that protects the function pointer.
  
Change log:
v5 -> v6:
--------
* Replaced struct kvm_s390_module_hook with function pointer
  int (*crypto_hook)(struct kvm_vcpu *vcpu) 

Tony Krowiak (2):
  s390/vfio-ap: clean up mdev resources when remove callback invoked
  s390/vfio-ap: r/w lock for PQAP interception handler function pointer

 arch/s390/include/asm/kvm_host.h      |  8 +++----
 arch/s390/kvm/kvm-s390.c              |  1 +
 arch/s390/kvm/priv.c                  | 10 ++++----
 drivers/s390/crypto/vfio_ap_ops.c     | 33 ++++++++++++++-------------
 drivers/s390/crypto/vfio_ap_private.h |  2 +-
 5 files changed, 28 insertions(+), 26 deletions(-)

-- 
2.30.2