linux-kernel - RE: [PATCH net, 2/2] net: mana: Fix accessing freed irq affinity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 29 Jan 2023 19:05:24 +0000
From:   Haiyang Zhang <haiyangz@...rosoft.com>
To:     Haiyang Zhang <haiyangz@...rosoft.com>,
        "Michael Kelley (LINUX)" <mikelley@...rosoft.com>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
CC:     Dexuan Cui <decui@...rosoft.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Paul Rosswurm <paulros@...rosoft.com>,
        "olaf@...fle.de" <olaf@...fle.de>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH net, 2/2] net: mana: Fix accessing freed irq affinity_hint



> -----Original Message-----
> From: Haiyang Zhang <haiyangz@...rosoft.com>
> Sent: Sunday, January 29, 2023 1:51 PM
> To: Michael Kelley (LINUX) <mikelley@...rosoft.com>; linux-
> hyperv@...r.kernel.org; netdev@...r.kernel.org
> Cc: Dexuan Cui <decui@...rosoft.com>; KY Srinivasan <kys@...rosoft.com>;
> Paul Rosswurm <paulros@...rosoft.com>; olaf@...fle.de;
> vkuznets@...hat.com; davem@...emloft.net; linux-kernel@...r.kernel.org;
> stable@...r.kernel.org
> Subject: RE: [PATCH net, 2/2] net: mana: Fix accessing freed irq affinity_hint
> 
> 
> 
> > -----Original Message-----
> > From: Michael Kelley (LINUX) <mikelley@...rosoft.com>
> > Sent: Sunday, January 29, 2023 9:27 AM
> > To: Haiyang Zhang <haiyangz@...rosoft.com>; linux-
> hyperv@...r.kernel.org;
> > netdev@...r.kernel.org
> > Cc: Haiyang Zhang <haiyangz@...rosoft.com>; Dexuan Cui
> > <decui@...rosoft.com>; KY Srinivasan <kys@...rosoft.com>; Paul
> Rosswurm
> > <paulros@...rosoft.com>; olaf@...fle.de; vkuznets@...hat.com;
> > davem@...emloft.net; linux-kernel@...r.kernel.org;
> stable@...r.kernel.org
> > Subject: RE: [PATCH net, 2/2] net: mana: Fix accessing freed irq affinity_hint
> >
> > From: LKML haiyangz <lkmlhyz@...rosoft.com> On Behalf Of Haiyang
> Zhang
> > Sent: Thursday, January 26, 2023 1:05 PM
> > >
> > > After calling irq_set_affinity_and_hint(), the cpumask pointer is
> > > saved in desc->affinity_hint, and will be used later when reading
> > > /proc/irq/<num>/affinity_hint. So the cpumask variable needs to be
> > > allocated per irq, and available until freeing the irq. Otherwise,
> > > we are accessing freed memory when reading the affinity_hint file.
> > >
> > > To fix the bug, allocate the cpumask per irq, and free it just
> > > before freeing the irq.
> >
> > Since the cpumask being passed to irq_set_affinity_and_hint()
> > always contains exactly one CPU, the code can be considerably
> > simplified by using the pre-calculated and persistent masks
> > available as cpumask_of(cpu).  All allocation of cpumasks in this
> > code goes away, and you can set the affinity_hint to NULL in the
> > cleanup and remove paths without having to free any masks.
> >
> Great idea!
> Will update the patch accordingly.

Also, I saw this alloc isn't necessary either:
	cpus = kcalloc(nvec, sizeof(*cpus), GFP_KERNEL);

We can simply use the return from cpumask_local_spread()
without saving all cpu numbers in a tmp array.

I will clean this up too :)

Thanks,
- Haiyang