linux-kernel - Re: [PATCH] base/node.c: initialize the accessor list before registering

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZUCJjpQtgGbT8Z0P@memverge.com>
Date:   Tue, 31 Oct 2023 00:58:54 -0400
From:   Gregory Price <gregory.price@...verge.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Gregory Price <gourry.memverge@...il.com>,
        linux-kernel@...r.kernel.org, rafael@...nel.org
Subject: Re: [PATCH] base/node.c: initialize the accessor list before
 registering

On Tue, Oct 31, 2023 at 07:03:17AM +0100, Greg KH wrote:
> On Mon, Oct 30, 2023 at 12:42:39AM -0400, Gregory Price wrote:
> > The current code registers the node as available in the node array
> > before initializing the accessor list.  This makes it so that
> > anything which might access the accessor list as a result of
> > allocations will cause an undefined memory access.
> > 
> > In one example, an extension to access hmat data during interleave
> > caused this undefined access as a result of a bulk allocation
> > that occurs during node initialization but before the accessor
> > list is initialized.
> 
> Is this an in-kernel driver that causes this problem?
> 

I discovered this why testing an RFC:
https://lore.kernel.org/linux-mm/ZUCCoCRS3cohf9OE@memverge.com/T/#t

However I noticed that there are two exposed interfaces which may
allow a caller to hit the unitialized accessor list.  I haven't
explicitly demonstrated this, though.

1) register_memory_node_under_compute_node
2) node_set_perf_attrs

Since `register_node` calls into device_register and inevitably hits
allocators, it seems like fully initializing the node struct before
going off into the aether was appropriate.

> > 
> > Initialize the accessor list before making the node generally
> > available to the global system.
> > 
> > Signed-off-by: Gregory Price <gregory.price@...verge.com>
> 
> What commit id does this fix?
>

Sorry:
Fixes: 08d9dbe72b1f ("node: Link memory nodes to their compute nodes")

> thanks,
> 
> greg k-h