linux-kernel - Re: [PATCH] dmabuf: fix dmabuf file poll uaf issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 1 Apr 2024 14:52:02 +0800
From: zhiguojiang <justinjiang@...o.com>
To: "T.J. Mercier" <tjmercier@...gle.com>
Cc: Sumit Semwal <sumit.semwal@...aro.org>,
 Christian König <christian.koenig@....com>,
 linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org,
 linaro-mm-sig@...ts.linaro.org, linux-kernel@...r.kernel.org,
 opensource.kernel@...o.com
Subject: Re: [PATCH] dmabuf: fix dmabuf file poll uaf issue

Hi T.J.,

> What is the most recent kernel version you've seen the bug on?
The latest kernel version of the issue we discovered is kernel-6.1.25, and
kernel-5.15 also reported this issue.
> You are closing the dmabuf fd from another thread while it is still
> part of the epoll interest list?
Yes, we found that threads related to android.display modules performed
an operation to close this dmabuf fd while it was still part of the 
epoll interest
list,  but the specific threads were random. So I think this is also 
issue with
the logic of kernel dmabuf code.

Thanks,
Zhiguo


在 2024/3/30 7:36, T.J. Mercier 写道:
> [你通常不会收到来自 tjmercier@...gle.com 的电子邮件。请访问 https://aka.ms/LearnAboutSenderIdentification，以了解这一点为什么很重要]
>
> On Tue, Mar 26, 2024 at 7:29 PM Zhiguo Jiang <justinjiang@...o.com> wrote:
>> The issue is a UAF issue of dmabuf file fd. Throght debugging, we found
>> that the dmabuf file fd is added to the epoll event listener list, and
>> when it is released, it is not removed from the epoll list, which leads
>> to the UAF(Use-After-Free) issue.
>>
>> The UAF issue can be solved by checking dmabuf file->f_count value and
>> skipping the poll operation for the closed dmabuf file in the
>> dma_buf_poll(). We have tested this solved patch multiple times and
>> have not reproduced the uaf issue.
>>
> Hi Zhiguo,
>
> What is the most recent kernel version you've seen the bug on?
>
> You are closing the dmabuf fd from another thread while it is still
> part of the epoll interest list?
>
> Thanks,
> T.J.