linux-kernel - Re: [PATCH] drm/scheduler: set entity to NULL in drm_sched_entity_pop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3098ac42-6a1a-d931-3299-54c5d17d6b93@amd.com>
Date:   Fri, 31 Mar 2023 08:57:44 -0400
From:   Luben Tuikov <luben.tuikov@....com>
To:     Christian König <christian.koenig@....com>,
        Danilo Krummrich <dakr@...hat.com>, airlied@...il.com,
        daniel@...ll.ch, l.stach@...gutronix.de,
        "Prosyak, Vitaly" <Vitaly.Prosyak@....com>
Cc:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/scheduler: set entity to NULL in
 drm_sched_entity_pop_job()

On 2023-03-31 01:59, Christian König wrote:
> Am 31.03.23 um 02:06 schrieb Danilo Krummrich:
>> It already happend a few times that patches slipped through which
>> implemented access to an entity through a job that was already removed
>> from the entities queue. Since jobs and entities might have different
>> lifecycles, this can potentially cause UAF bugs.
>>
>> In order to make it obvious that a jobs entity pointer shouldn't be
>> accessed after drm_sched_entity_pop_job() was called successfully, set
>> the jobs entity pointer to NULL once the job is removed from the entity
>> queue.
>>
>> Moreover, debugging a potential NULL pointer dereference is way easier
>> than potentially corrupted memory through a UAF.
>>
>> Signed-off-by: Danilo Krummrich <dakr@...hat.com>
> 
> In general "YES PLEASE!", but I fear that this will break amdgpus reset 
> sequence.
> 
> On the other hand when amdgpu still relies on that pointer it's clearly 
> a bug (which I pointed out tons of times before).
> 
> Luben any opinion on that? Could you drive cleaning that up as well?

Hi Christian,

No worries, yes, I'll take a look at this after breakfast.

> 
> Thanks,
> Christian.
> 
>> ---
>> I'm aware that drivers could already use job->entity in arbitrary places, since
>> they in control of when the entity is actually freed. A quick grep didn't give
>> me any results where this would actually be the case, however maybe I also just
>> didn't catch it.
>>
>> If, therefore, we don't want to set job->entity to NULL I think we should at
>> least add a comment somewhere.

I agree with the sentiment of this patch. I'll have to take a closer look at this
because there was some indirect pointer dependency due to the way the FIFO was implemented,
and I review the code every 3-6 months to remind me of that--maybe it's related, maybe
not. But this looks like a something we can delve into and at best come up with a comment
explaining what's going on and why.

We haven't seen any oopses so far the way this is, and any new patches which evoke
an oops, may be doing something they shouldn't. I'll take a look.

Any indication of what these new patches were doing?

Regards,
Luben

>> ---
>>
>>   drivers/gpu/drm/scheduler/sched_entity.c | 6 ++++++
>>   1 file changed, 6 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c
>> index 15d04a0ec623..a9c6118e534b 100644
>> --- a/drivers/gpu/drm/scheduler/sched_entity.c
>> +++ b/drivers/gpu/drm/scheduler/sched_entity.c
>> @@ -448,6 +448,12 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)
>>   			drm_sched_rq_update_fifo(entity, next->submit_ts);
>>   	}
>>   
>> +	/* Jobs and entities might have different lifecycles. Since we're
>> +	 * removing the job from the entities queue, set the jobs entity pointer
>> +	 * to NULL to prevent any future access of the entity through this job.
>> +	 */
>> +	sched_job->entity = NULL;
>> +
>>   	return sched_job;
>>   }
>>   
>