linux-kernel - Re: [PATCH] iommu: iommufd: fix WARNING in iommufd_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250114175051.GN26854@ziepe.ca>
Date: Tue, 14 Jan 2025 13:50:51 -0400
From: Jason Gunthorpe <jgg@...pe.ca>
To: Suraj Sonawane <surajsonawane0215@...il.com>
Cc: kevin.tian@...el.com, joro@...tes.org, will@...nel.org,
	robin.murphy@....com, iommu@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com
Subject: Re: [PATCH] iommu: iommufd: fix WARNING in iommufd_device_unbind

On Sun, Nov 24, 2024 at 01:29:00AM +0530, Suraj Sonawane wrote:
> Fix an issue detected by syzbot:
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Resolve a warning in iommufd_device_unbind caused by a
> timeout while waiting for the shortterm_users reference
> count to reach zero. The existing 10-second timeout is
> insufficient in some scenarios, resulting in failures
> and the following warning:
> 
> WARNING in iommufd_device_unbind
> iommufd: Time out waiting for iommufd object to become free
> 
> Increase the timeout in iommufd_object_dec_wait_shortterm
> from 10 seconds to 12 seconds (msecs_to_jiffies(12000))
> to allow sufficient time for the reference count to drop
> to zero. This change prevents premature timeouts and reduces
> the likelihood of warnings during iommufd_device_unbind.
> 
> The fix has been tested and validated by syzbot. This patch
> closes the bug reported at the following syzkaller link.
> 
> 
> Reported-by: syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com 
> Closes: https://syzkaller.appspot.com/bug?extid=c92878e123785b1fa2db 
> Tested-by: syzbot+c92878e123785b1fa2db@...kaller.appspotmail.com 
> Fixes: 6f9c4d8c468c ("iommufd: Do not UAF during iommufd_put_object") 
> Signed-off-by: Suraj Sonawane <surajsonawane0215@...il.com>
> ---
>  drivers/iommu/iommufd/main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

I've taken this but I increased the timeout to 60s, which is similar
to other such timeouts in the kernel

Though I do wonder what syzkaller has done to hit this..

Thanks,
Jason