Message-ID: <CAJedcCzmadeTp8-OYTsRw3CQjMKtzYTRW5b-eXT_U3sOvZZxfA@mail.gmail.com>
Date:   Fri, 16 Sep 2022 23:20:32 +0800
From:   Zheng Hacker <hackerzheng666@...il.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     xmzyshypnc <1002992920@...com>, dimitri.sivanich@....com,
        arnd@...db.de, linux-kernel@...r.kernel.org,
        alex000young@...il.com, security@...nel.org
Subject: Re: [PATCH] misc: sgi-gru: fix use-after-free error in
 gru_set_context_option, gru_fault and gru_handle_user_call_os

>From 7cdd08c87a3252ffa081997146dd9c3adcb37f1c Mon Sep 17 00:00:00 2001
From: xmzyshypnc <1002992920@...com>
Date: Fri, 16 Sep 2022 17:54:07 +0800
Subject: [PATCH] misc: sgi-gru: fix use-after-free error in
 gru_set_context_option, gru_fault and gru_handle_user_call_os

In grufile.c, gru_file_unlocked_ioctl function can be called by user.

If the req is GRU_SET_CONTEXT_OPTION, it will call gru_set_context_option.

In gru_set_context_option, as req can be controlled by user,

We can reach gru_check_context_placement function call.

In gru_check_context_placement function, if the error path was steped,

say gru_check_chiplet_assignment return 0,

Then it will fall into gru_unload_context function.

And it will finnaly call kfree gts in gts_drop function.

Then gru_unlock_gts will be called in gru_set_context_option function.

This is a typical Use after free.

The same problem exists in gru_handle_user_call_os and gru_fault.

Fix it by introduce the return value to see if gts is in good case or not.

Free the gts in caller when gru_check_chiplet_assignment check failed.

Signed-off-by: xmzyshypnc <1002992920@...com>
---
 drivers/misc/sgi-gru/grufault.c  | 14 ++++++++++++--
 drivers/misc/sgi-gru/grumain.c   | 17 +++++++++++++----
 drivers/misc/sgi-gru/grutables.h |  2 +-
 3 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufault.c
index d7ef61e602ed..2b5b049fbd38 100644
--- a/drivers/misc/sgi-gru/grufault.c
+++ b/drivers/misc/sgi-gru/grufault.c
@@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb)
  if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
  goto exit;

- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
+ if (ret)
+ goto err;

  /*
  * CCH may contain stale data if ts_force_cch_reload is set.
@@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb)
 exit:
  gru_unlock_gts(gts);
  return ret;
+err:
+ gru_unlock_gts(gts);
+ gru_unload_context(gts, 1);
+ return -EINVAL;
 }

 /*
@@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg)
  } else {
  gts->ts_user_blade_id = req.val1;
  gts->ts_user_chiplet_id = req.val0;
- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
  }
  break;
  case sco_gseg_owner:
@@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg)
  ret = -EINVAL;
  }
  gru_unlock_gts(gts);
+ if (ret) {
+ gru_unload_context(gts, 1);
+ ret = -EINVAL;
+ }

  return ret;
 }
diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c
index 9afda47efbf2..79903cf7e706 100644
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct
gru_state *gru,
  * chiplet. Misassignment can occur if the process migrates to a different
  * blade or if the user changes the selected blade/chiplet.
  */
-void gru_check_context_placement(struct gru_thread_state *gts)
+int gru_check_context_placement(struct gru_thread_state *gts)
 {
  struct gru_state *gru;
+ int ret = 0;

  /*
  * If the current task is the context owner, verify that the
@@ -727,14 +728,16 @@ void gru_check_context_placement(struct
gru_thread_state *gts)
  */
  gru = gts->ts_gru;
  if (!gru || gts->ts_tgid_owner != current->tgid)
- return;
+ return ret;

  if (!gru_check_chiplet_assignment(gru, gts)) {
  STAT(check_context_unload);
- gru_unload_context(gts, 1);
+ ret = -EINVAL;
  } else if (gru_retarget_intr(gts)) {
  STAT(check_context_retarget_intr);
  }
+
+ return ret;
 }


@@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
  struct gru_thread_state *gts;
  unsigned long paddr, vaddr;
  unsigned long expires;
+ int ret;

  vaddr = vmf->address;
  gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
@@ -934,7 +938,12 @@ vm_fault_t gru_fault(struct vm_fault *vmf)
  mutex_lock(&gts->ts_ctxlock);
  preempt_disable();

- gru_check_context_placement(gts);
+ ret = gru_check_context_placement(gts);
+ if (ret) {
+ mutex_unlock(&gts->ts_ctxlock);
+ gru_unload_context(gts, 1);
+ return ret;
+ }

  if (!gts->ts_gru) {
  STAT(load_user_context);
diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutables.h
index 5efc869fe59a..f4a5a787685f 100644
--- a/drivers/misc/sgi-gru/grutables.h
+++ b/drivers/misc/sgi-gru/grutables.h
@@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
 extern int gru_user_unload_context(unsigned long arg);
 extern int gru_get_exception_detail(unsigned long arg);
 extern int gru_set_context_option(unsigned long address);
-extern void gru_check_context_placement(struct gru_thread_state *gts);
+extern int gru_check_context_placement(struct gru_thread_state *gts);
 extern int gru_cpu_fault_map_id(void);
 extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
 extern void gru_flush_all_tlb(struct gru_state *gru);
-- 
2.25.1

Powered by blists - more mailing lists