linux-kernel - Re: [PATCH v1] s390/vfio-ap: Signal eventfd when guest AP configuration is changed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250116201858.1a5f7e7f.pasic@linux.ibm.com>
Date: Thu, 16 Jan 2025 20:18:58 +0100
From: Halil Pasic <pasic@...ux.ibm.com>
To: Alex Williamson <alex.williamson@...hat.com>
Cc: Anthony Krowiak <akrowiak@...ux.ibm.com>,
        Rorie Reyes
 <rreyes@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org, hca@...ux.ibm.com,
        borntraeger@...ibm.com, agordeev@...ux.ibm.com, gor@...ux.ibm.com,
        jjherne@...ux.ibm.com, Halil Pasic <pasic@...ux.ibm.com>
Subject: Re: [PATCH v1] s390/vfio-ap: Signal eventfd when guest AP
 configuration is changed

On Thu, 16 Jan 2025 11:52:28 -0500
Alex Williamson <alex.williamson@...hat.com> wrote:

> > > Alex, does the above answer your question on what guards against UAF (the
> > > short answer is: matrix_dev->mdevs_lock)?    
> 
> Yes, that answers my question, thanks for untangling it.  We might
> consider a lockdep_assert_held() in the new
> signal_guest_ap_cfg_changed() since it does get called from a variety
> of paths and we need that lock to prevent the UAF.

Yes I second that! I was thinking about it myself yesterday. And there
are also a couple of other functions that expect to be called with
certain locks held. I would love to see lockdep_assert_held() there
as well.

Since I went through that code last night I could spin a patch that
catches some of these at least. But if I don't within two weeks, I
won't be grumpy if somebody else picks that up.

Regards,
Halil