linux-kernel - Re: [PATCH 2/2] random: spread out jitter callback to different CPUs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yz7JXEaTFWa1VLKJ@zx2c4.com>
Date:   Thu, 6 Oct 2022 06:26:04 -0600
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc:     linux-kernel@...r.kernel.org, linux-crypto@...r.kernel.org,
        Dominik Brodowski <linux@...inikbrodowski.net>,
        Sultan Alsawaf <sultan@...neltoast.com>
Subject: Re: [PATCH 2/2] random: spread out jitter callback to different CPUs

On Thu, Oct 06, 2022 at 08:46:27AM +0200, Sebastian Andrzej Siewior wrote:
> On 2022-10-05 23:08:19 [+0200], Jason A. Donenfeld wrote:
> > Hi Sebastian,
> Hi Jason,
> 
> > On Wed, Oct 05, 2022 at 07:26:42PM +0200, Sebastian Andrzej Siewior wrote:
> > > That del_timer_sync() at the end is what you want. If the timer is
> > > pending (as in enqueued in the timer wheel) then it will be removed
> > > before it is invoked. If the timer's callback is invoked then it will
> > > spin until the callback is done.
> > 
> > del_timer_sync() is not guaranteed to succeed with add_timer_on() being
> > used in conjunction with timer_pending() though. That's why I've
> > abandoned this.
> 
> But why? The timer is added to a timer-base on a different CPU. Should
> work.

So it's easier to talk about, I'll number a few lines:

 1 while (conditions) {
 2     if (!timer_pending(&stack.timer))
 3         add_timer_on(&stack.timer, some_next_cpu);
 4 }
 5 del_timer_sync(&stack.timer);

Then, steps to cause UaF:

a) add_timer_on() on line 3 is called from CPU 1 and pends the timer on
   CPU 2.

b) Just before the timer callback runs, not after, timer_pending() is
   made false, so the condition on line 2 holds true again.

c) add_timer_on() on line 3 is called from CPU 1 and pends the timer on
   CPU 3.

d) The conditions on line 1 are made false, and the loop breaks.

e) del_timer_sync() on line 5 is called, and its `base->running_timer !=
   timer` check is false, because of step (c).

f) `stack.timer` gets freed / goes out of scope.

g) The callback scheduled from step (b) runs, and we have a UaF.

That's, anyway, what I understand Sultan to have pointed out to me. In
looking at this closely, though, to write this email, I noticed that
add_timer_on() does set TIMER_MIGRATING, which lock_timer_base() spins
on. So actually, maybe this scenario should be accounted for? Sultan, do
you care to comment here?

Jason