linux-kernel - RE: [PATCH v3 06/15] vfio/mtty: Use the new device life cycle helpers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BN9PR11MB5276F8872ABDFAEB8A8C2AE78C4C9@BN9PR11MB5276.namprd11.prod.outlook.com>
Date:   Tue, 20 Sep 2022 22:52:57 +0000
From:   "Tian, Kevin" <kevin.tian@...el.com>
To:     Alex Williamson <alex.williamson@...hat.com>
CC:     Zhenyu Wang <zhenyuw@...ux.intel.com>,
        "Wang, Zhi A" <zhi.a.wang@...el.com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        "Joonas Lahtinen" <joonas.lahtinen@...ux.intel.com>,
        "Vivi, Rodrigo" <rodrigo.vivi@...el.com>,
        Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Eric Farman <farman@...ux.ibm.com>,
        Matthew Rosato <mjrosato@...ux.ibm.com>,
        Halil Pasic <pasic@...ux.ibm.com>,
        Vineeth Vijayan <vneethv@...ux.ibm.com>,
        "Peter Oberparleiter" <oberpar@...ux.ibm.com>,
        Heiko Carstens <hca@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Tony Krowiak <akrowiak@...ux.ibm.com>,
        Jason Herne <jjherne@...ux.ibm.com>,
        Harald Freudenberger <freude@...ux.ibm.com>,
        Diana Craciun <diana.craciun@....nxp.com>,
        "Cornelia Huck" <cohuck@...hat.com>,
        Longfang Liu <liulongfang@...wei.com>,
        "Shameer Kolothum" <shameerali.kolothum.thodi@...wei.com>,
        Jason Gunthorpe <jgg@...pe.ca>,
        Yishai Hadas <yishaih@...dia.com>,
        Eric Auger <eric.auger@...hat.com>,
        Kirti Wankhede <kwankhede@...dia.com>,
        "Leon Romanovsky" <leon@...nel.org>,
        Abhishek Sahu <abhsahu@...dia.com>,
        "Christoph Hellwig" <hch@...radead.org>,
        "intel-gvt-dev@...ts.freedesktop.org" 
        <intel-gvt-dev@...ts.freedesktop.org>,
        "intel-gfx@...ts.freedesktop.org" <intel-gfx@...ts.freedesktop.org>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "Liu, Yi L" <yi.l.liu@...el.com>
Subject: RE: [PATCH v3 06/15] vfio/mtty: Use the new device life cycle helpers

> From: Alex Williamson <alex.williamson@...hat.com>
> Sent: Wednesday, September 21, 2022 3:17 AM
> 
> On Fri,  9 Sep 2022 18:22:38 +0800
> Kevin Tian <kevin.tian@...el.com> wrote:
> 
> > From: Yi Liu <yi.l.liu@...el.com>
> >
> > and manage available ports inside @init/@...ease.
> >
> > Signed-off-by: Yi Liu <yi.l.liu@...el.com>
> > Signed-off-by: Kevin Tian <kevin.tian@...el.com>
> > Reviewed-by: Jason Gunthorpe <jgg@...dia.com>
> > ---
> >  samples/vfio-mdev/mtty.c | 67 +++++++++++++++++++++++-----------------
> >  1 file changed, 39 insertions(+), 28 deletions(-)
> >
> > diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> > index f42a59ed2e3f..41301d50b247 100644
> > --- a/samples/vfio-mdev/mtty.c
> > +++ b/samples/vfio-mdev/mtty.c
> ...
> > +static int mtty_probe(struct mdev_device *mdev)
> > +{
> > +	struct mdev_state *mdev_state;
> > +	int ret;
> > +
> > +	mdev_state = vfio_alloc_device(mdev_state, vdev, &mdev->dev,
> > +				       &mtty_dev_ops);
> > +	if (IS_ERR(mdev_state))
> > +		return PTR_ERR(mdev_state);
> >
> >  	ret = vfio_register_emulated_iommu_dev(&mdev_state->vdev);
> >  	if (ret)
> > -		goto err_vconfig;
> > +		goto err_put_vdev;
> >  	dev_set_drvdata(&mdev->dev, mdev_state);
> >  	return 0;
> >
> > -err_vconfig:
> > -	kfree(mdev_state->vconfig);
> > -err_state:
> > -	vfio_uninit_group_dev(&mdev_state->vdev);
> > -	kfree(mdev_state);
> > -err_nr_ports:
> > -	atomic_add(nr_ports, &mdev_avail_ports);
> > +err_put_vdev:
> > +	vfio_put_device(&mdev_state->vdev);
> >  	return ret;
> >  }
> >
> > +static void mtty_release_dev(struct vfio_device *vdev)
> > +{
> > +	struct mdev_state *mdev_state =
> > +		container_of(vdev, struct mdev_state, vdev);
> > +
> > +	kfree(mdev_state->vconfig);
> > +	vfio_free_device(vdev);
> > +	atomic_add(mdev_state->nr_ports, &mdev_avail_ports);
> 
> I must be missing something, isn't this a use-after-free?

Yes, it's a use-after-free indeed. Thanks for catching it!

> 
> mdev_state is allocated via vfio_alloc_device(), where vdev is the
> first entry in that structure, so this is equivalent to
> kvfree(mdev_state).  mbochs has the same issue.  mdpy and vfio-ap
> adjust global counters after vfio_free_device(), which I think muddies
> the situation.  Shouldn't we look suspiciously at any .release callback
> where vfio_free_device() isn't the last thing executed?  Thanks,
> 

Yes. I'll scrutinize it again. To be consistent I'll make sure the free
is the last line in all .release callbacks though not required for
some (e.g. mdpy and vfio-ap).