linux-kernel - [PATCH] iommu: iommufd: fix WARNING in iommufd_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20241123195900.3176-1-surajsonawane0215@gmail.com>
Date: Sun, 24 Nov 2024 01:29:00 +0530
From: Suraj Sonawane <surajsonawane0215@...il.com>
To: jgg@...pe.ca,
	kevin.tian@...el.com,
	joro@...tes.org,
	will@...nel.org,
	robin.murphy@....com
Cc: iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Suraj Sonawane <surajsonawane0215@...il.com>,
	syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com
Subject: [PATCH] iommu: iommufd: fix WARNING in iommufd_device_unbind

Fix an issue detected by syzbot:
WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Resolve a warning in iommufd_device_unbind caused by a
timeout while waiting for the shortterm_users reference
count to reach zero. The existing 10-second timeout is
insufficient in some scenarios, resulting in failures
and the following warning:

WARNING in iommufd_device_unbind
iommufd: Time out waiting for iommufd object to become free

Increase the timeout in iommufd_object_dec_wait_shortterm
from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
to allow sufficient time for the reference count to drop
to zero. This change prevents premature timeouts and reduces
the likelihood of warnings during iommufd_device_unbind.

The fix has been tested and validated by syzbot. This patch
closes the bug reported at the following syzkaller link.


Reported-by: syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com 
Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
Tested-by: syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com 
Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
Signed-off-by: Suraj Sonawane <surajsonawane0215@...il.com>
---
 drivers/iommu/iommufd/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
index d2683ad82..954c021e9 100644
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -104,7 +104,7 @@ static int iommufd_object_dec_wait_shortterm(struct iommufd_ctx *ictx,
 	if (wait_event_timeout(ictx->destroy_wait,
 				refcount_read(&to_destroy->shortterm_users) ==
 					0,
-				msecs_to_jiffies(10000)))
+				msecs_to_jiffies(12000)))
 		return 0;
 
 	pr_crit("Time out waiting for iommufd object to become free\n");
-- 
2.34.1