linux-kernel - Re: [PATCH v5] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202210271443.nUxey7LZ-lkp@intel.com>
Date:   Thu, 27 Oct 2022 14:28:34 +0800
From:   kernel test robot <lkp@...el.com>
To:     Zheng Wang <zyytlz.wz@....com>, gregkh@...uxfoundation.org
Cc:     oe-kbuild-all@...ts.linux.dev, zhengyejian1@...wei.com,
        dimitri.sivanich@....com, arnd@...db.de,
        linux-kernel@...r.kernel.org, hackerzheng666@...il.com,
        alex000young@...il.com, Zheng Wang <zyytlz.wz@....com>
Subject: Re: [PATCH v5] misc: sgi-gru: fix use-after-free error in
  gru_set_context_option, gru_fault and gru_handle_user_call_os

Hi Zheng,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on char-misc/char-misc-testing]
[also build test WARNING on linus/master v6.1-rc2 next-20221026]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Zheng-Wang/misc-sgi-gru-fix-use-after-free-error-in-gru_set_context_option-gru_fault-and-gru_handle_user_call_os/20221027-120633
patch link:    https://lore.kernel.org/r/20221027040455.115035-1-zyytlz.wz%40163.com
patch subject: [PATCH v5] misc: sgi-gru: fix use-after-free error in  gru_set_context_option, gru_fault and gru_handle_user_call_os
config: x86_64-allyesconfig
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/c93eb9fc5a22e105d7ebb1a23fe110262c95a177
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Zheng-Wang/misc-sgi-gru-fix-use-after-free-error-in-gru_set_context_option-gru_fault-and-gru_handle_user_call_os/20221027-120633
        git checkout c93eb9fc5a22e105d7ebb1a23fe110262c95a177
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/misc/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@...el.com>

All warnings (new ones prefixed by >>):

   drivers/misc/sgi-gru/grumain.c: In function 'gru_fault':
>> drivers/misc/sgi-gru/grumain.c:925:13: warning: unused variable 'ret' [-Wunused-variable]
     925 |         int ret;
         |             ^~~


vim +/ret +925 drivers/misc/sgi-gru/grumain.c

   911	
   912	/*
   913	 * gru_nopage
   914	 *
   915	 * Map the user's GRU segment
   916	 *
   917	 * 	Note: gru segments alway mmaped on GRU_GSEG_PAGESIZE boundaries.
   918	 */
   919	vm_fault_t gru_fault(struct vm_fault *vmf)
   920	{
   921		struct vm_area_struct *vma = vmf->vma;
   922		struct gru_thread_state *gts;
   923		unsigned long paddr, vaddr;
   924		unsigned long expires;
 > 925		int ret;
   926	
   927		vaddr = vmf->address;
   928		gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n",
   929			vma, vaddr, GSEG_BASE(vaddr));
   930		STAT(nopfn);
   931	
   932		/* The following check ensures vaddr is a valid address in the VMA */
   933		gts = gru_find_thread_state(vma, TSID(vaddr, vma));
   934		if (!gts)
   935			return VM_FAULT_SIGBUS;
   936	
   937	again:
   938		mutex_lock(&gts->ts_ctxlock);
   939		preempt_disable();
   940	
   941		if (gru_check_context_placement(gts)) {
   942			preempt_enable();
   943			mutex_unlock(&gts->ts_ctxlock);
   944			gru_unload_context(gts, 1);
   945			return VM_FAULT_NOPAGE;
   946		}
   947	
   948		if (!gts->ts_gru) {
   949			STAT(load_user_context);
   950			if (!gru_assign_gru_context(gts)) {
   951				preempt_enable();
   952				mutex_unlock(&gts->ts_ctxlock);
   953				set_current_state(TASK_INTERRUPTIBLE);
   954				schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
   955				expires = gts->ts_steal_jiffies + GRU_STEAL_DELAY;
   956				if (time_before(expires, jiffies))
   957					gru_steal_context(gts);
   958				goto again;
   959			}
   960			gru_load_context(gts);
   961			paddr = gseg_physical_address(gts->ts_gru, gts->ts_ctxnum);
   962			remap_pfn_range(vma, vaddr & ~(GRU_GSEG_PAGESIZE - 1),
   963					paddr >> PAGE_SHIFT, GRU_GSEG_PAGESIZE,
   964					vma->vm_page_prot);
   965		}
   966	
   967		preempt_enable();
   968		mutex_unlock(&gts->ts_ctxlock);
   969	
   970		return VM_FAULT_NOPAGE;
   971	}
   972	

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp

View attachment "config" of type "text/plain" (291877 bytes)