linux-kernel - [PATCH v5 2/5] arm64: amu: Rule out potential use after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240417093848.1555462-3-beata.michalska@arm.com>
Date: Wed, 17 Apr 2024 10:38:45 +0100
From: Beata Michalska <beata.michalska@....com>
To: linux-kernel@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org,
	ionela.voinescu@....com,
	vanshikonda@...amperecomputing.com
Cc: sudeep.holla@....com,
	will@...nel.org,
	catalin.marinas@....com,
	vincent.guittot@...aro.org,
	sumitg@...dia.com,
	yang@...amperecomputing.com,
	lihuisong@...wei.com,
	viresh.kumar@...aro.org
Subject: [PATCH v5 2/5] arm64: amu: Rule out potential use after free

For the time being, the amu_fie_cpus cpumask is being exclusively used
by the AMU-related internals of FIE support and is guaranteed to be
valid on every access currently made. Still the mask is not being
invalidated on one of the error handling code paths, which leaves
a soft spot with potential risk of uaf for CPUMASK_OFFSTACK cases.
To make things sound, set the cpumaks pointer explicitly to NULL upon
failing to register the cpufreq notifier.
Note that, due to the quirks of CPUMASK_OFFSTACK, this change needs to
be wrapped with grim ifdefing (it would be better served by
incorporating this into free_cpumask_var ...)

Signed-off-by: Beata Michalska <beata.michalska@....com>
---
 arch/arm64/kernel/topology.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c
index 1a2c72f3e7f8..3c814a278534 100644
--- a/arch/arm64/kernel/topology.c
+++ b/arch/arm64/kernel/topology.c
@@ -244,8 +244,12 @@ static int __init init_amu_fie(void)

 	ret = cpufreq_register_notifier(&init_amu_fie_notifier,
 					CPUFREQ_POLICY_NOTIFIER);
-	if (ret)
+	if (ret) {
 		free_cpumask_var(amu_fie_cpus);
+#ifdef CONFIG_CPUMASK_OFFSTACK
+		amu_fie_cpus = NULL;
+#endif
+	}

 	return ret;
 }
-- 
2.25.1