| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <dfbca7cc-1e9d-4c78-9790-adcfdf0e2fa4@arm.com>
Date: Mon, 6 Jan 2025 15:23:33 +0000
From: Suzuki K Poulose <suzuki.poulose@....com>
To: Yeo Reum Yun <YeoReum.Yun@....com>,
"mike.leach@...aro.org" <mike.leach@...aro.org>,
"james.clark@...aro.org" <james.clark@...aro.org>,
"alexander.shishkin@...ux.intel.com" <alexander.shishkin@...ux.intel.com>
Cc: "coresight@...ts.linaro.org" <coresight@...ts.linaro.org>,
"linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
nd <nd@....com>
Subject: Re: [PATCH 1/1] coresight: prevent deactivate active config while
enable the config
On 06/01/2025 13:41, Yeo Reum Yun wrote:
> Hi Suzuki,
>
> Sorry this ping was my mistake.
> As you said, v2 is the recent one.
> You can ignore this.
>
Thanks, will respond on v2.
Also, fyi, your emails not plain text ! Please fix your email client.
Suzuki
> Thanks!
> ------------------------------------------------------------------------
> *보낸 사람:* Suzuki K Poulose <suzuki.poulose@....com>
> *보낸 날짜:* Monday, January 6, 2025 1:37:40 PM
> *받는 사람:* Yeo Reum Yun <YeoReum.Yun@....com>; mike.leach@...aro.org
> <mike.leach@...aro.org>; james.clark@...aro.org
> <james.clark@...aro.org>; alexander.shishkin@...ux.intel.com
> <alexander.shishkin@...ux.intel.com>
> *참조:* coresight@...ts.linaro.org <coresight@...ts.linaro.org>; linux-
> arm-kernel@...ts.infradead.org <linux-arm-kernel@...ts.infradead.org>;
> linux-kernel@...r.kernel.org <linux-kernel@...r.kernel.org>; nd <nd@....com>
> *제목:* Re: [PATCH 1/1] coresight: prevent deactivate active config
> while enable the config
> Hi Yeo,
>
>
> On 31/12/2024 14:37, Yeo Reum Yun wrote:
>> Gentle ping in case of forgotten.
>>
>
> Gentle reminder: Please avoid top posting.
>
> I thought there is a v2 of this one ? I am now confused.
>
> Kind regards
> Suzuki
>
>> ________________________________________
>> From: Yeoreum Yun <yeoreum.yun@....com>
>> Sent: 18 December 2024 08:48
>> To: Suzuki Poulose; mike.leach@...aro.org; james.clark@...aro.org; alexander.shishkin@...ux.intel.com
>> Cc: coresight@...ts.linaro.org; linux-arm-kernel@...ts.infradead.org; linux-kernel@...r.kernel.org; nd; Yeo Reum Yun
>> Subject: [PATCH 1/1] coresight: prevent deactivate active config while enable the config
>>
>> While enable active config via cscfg_csdev_enable_active_config(),
>> active config could be deactivated via configfs' sysfs interface.
>> This could make UAF issue in below scenario:
>>
>> CPU0 CPU1
>> (perf or sysfs enable) load module
>> cscfg_load_config_sets()
>> activate config. // sysfs
>> (sys_active_cnt == 1)
>> ...
>> cscfg_csdev_enable_active_config()
>> lock(csdev->cscfg_csdev_lock)
>> // here load config activate by CPU1
>> unlock(csdev->cscfg_csdev_lock)
>>
>> deactivate config // sysfs
>> (sys_activec_cnt == 0)
>> cscfg_unload_config_sets()
>> unload module
>>
>> // access to config_desc which freed
>> // while unloading module.
>> cfs_csdev_enable_config
>>
>> To address this, introduce sys_enable_cnt in cscfg_mgr to prevent
>> deactivate while there is enabled configuration.
>>
>> Signed-off-by: Yeoreum Yun <yeoreum.yun@....com>
>> ---
>> .../hwtracing/coresight/coresight-etm4x-core.c | 3 +++
>> drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++--
>> drivers/hwtracing/coresight/coresight-syscfg.h | 2 ++
>> 3 files changed, 21 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
>> index 86893115df17..6218ef40acbc 100644
>> --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
>> +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
>> @@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev)
>> smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1);
>>
>> raw_spin_unlock(&drvdata->spinlock);
>> +
>> + cscfg_csdev_disable_active_config(csdev);
>> +
>> cpus_read_unlock();
>>
>> /*
>> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
>> index a70c1454b410..dfa7dcbaf25d 100644
>> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
>> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
>> @@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti
>> cscfg_mgr->sysfs_active_config = cfg_hash;
>> } else {
>> /* disable if matching current value */
>> - if (cscfg_mgr->sysfs_active_config == cfg_hash) {
>> + if (cscfg_mgr->sysfs_active_config == cfg_hash &&
>> + !atomic_read(&cscfg_mgr->sys_enable_cnt)) {
>> _cscfg_deactivate_config(cfg_hash);
>> cscfg_mgr->sysfs_active_config = 0;
>> } else
>> @@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
>> if (!atomic_read(&cscfg_mgr->sys_active_cnt))
>> return 0;
>>
>> + /*
>> + * increment sys_enable_cnt first to prevent deactivate the config
>> + * while enable active config.
>> + */
>> + atomic_inc(&cscfg_mgr->sys_enable_cnt);
>> +
>> /*
>> * Look for matching configuration - set the active configuration
>> * context if found.
>> @@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
>> raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
>> }
>> }
>> +
>> + if (!config_csdev_active || err)
>> + atomic_dec(&cscfg_mgr->sys_enable_cnt);
>> +
>> return err;
>> }
>> EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config);
>> @@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev)
>> if (config_csdev) {
>> if (!config_csdev->enabled)
>> config_csdev = NULL;
>> - else
>> + else {
>> config_csdev->enabled = false;
>> + atomic_dec(&cscfg_mgr->sys_enable_cnt);
>> + }
>> }
>> csdev->active_cscfg_ctxt = NULL;
>> raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
>> @@ -1179,6 +1192,7 @@ static int cscfg_create_device(void)
>> INIT_LIST_HEAD(&cscfg_mgr->config_desc_list);
>> INIT_LIST_HEAD(&cscfg_mgr->load_order_list);
>> atomic_set(&cscfg_mgr->sys_active_cnt, 0);
>> + atomic_set(&cscfg_mgr->sys_enable_cnt, 0);
>> cscfg_mgr->load_state = CSCFG_NONE;
>>
>> /* setup the device */
>> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h
>> index 66e2db890d82..2fc397919985 100644
>> --- a/drivers/hwtracing/coresight/coresight-syscfg.h
>> +++ b/drivers/hwtracing/coresight/coresight-syscfg.h
>> @@ -38,6 +38,7 @@ enum cscfg_load_ops {
>> * @config_desc_list: List of system configuration descriptors to load into registered devices.
>> * @load_order_list: Ordered list of owners for dynamically loaded configurations.
>> * @sys_active_cnt: Total number of active config descriptor references.
>> + * @sys_enable_cnt: Total number of enable of active config descriptor references.
>> * @cfgfs_subsys: configfs subsystem used to manage configurations.
>> * @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs.
>> * @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs.
>> @@ -50,6 +51,7 @@ struct cscfg_manager {
>> struct list_head config_desc_list;
>> struct list_head load_order_list;
>> atomic_t sys_active_cnt;
>> + atomic_t sys_enable_cnt;
>> struct configfs_subsystem cfgfs_subsys;
>> u32 sysfs_active_config;
>> int sysfs_active_preset;
>> --
>> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
>>
>
Powered by blists - more mailing lists