linux-kernel - Re: [PATCH v11 4/7] iommufd: Use iommufd_access_change_ioas in iommufd_access_destroy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 28 Jul 2023 09:42:45 -0300
From:   Jason Gunthorpe <jgg@...dia.com>
To:     Nicolin Chen <nicolinc@...dia.com>
Cc:     kevin.tian@...el.com, yi.l.liu@...el.com, joro@...tes.org,
        will@...nel.org, robin.murphy@....com, alex.williamson@...hat.com,
        shuah@...nel.org, linux-kernel@...r.kernel.org,
        iommu@...ts.linux.dev, kvm@...r.kernel.org,
        linux-kselftest@...r.kernel.org, mjrosato@...ux.ibm.com,
        farman@...ux.ibm.com
Subject: Re: [PATCH v11 4/7] iommufd: Use iommufd_access_change_ioas in
 iommufd_access_destroy_object

On Thu, Jul 27, 2023 at 11:33:26PM -0700, Nicolin Chen wrote:
> Update the unprotect routine in iommufd_access_destroy_object() to calling
> the new iommufd_access_change_ioas() helper. This will reduce some risk of
> race condition with another concurrent iommufd_access_replace/detach call.
> 
> Note that the behavior of this function call is changed: a WARN_ON will be
> triggered by a -EBUSY return code if there is another ongoing detach.

This should be completely impossible, at this point the object must
have a refcount of 0 so if another thread is concurrently detaching it
we are already UAFing.

Reviewed-by: Jason Gunthorpe <jgg@...dia.com>

Jason