From nobody Thu Apr 2 10:09:34 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4D76C07E9D for ; Mon, 26 Sep 2022 04:37:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232731AbiIZEhE (ORCPT ); Mon, 26 Sep 2022 00:37:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232677AbiIZEhA (ORCPT ); Mon, 26 Sep 2022 00:37:00 -0400 Received: from mail-m973.mail.163.com (mail-m973.mail.163.com [123.126.97.3]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id D8A8023162 for ; Sun, 25 Sep 2022 21:36:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:Subject:Date:Message-Id:MIME-Version; bh=upktR 5lgfIuLOHJPkkkdFm6RUFNixxRyonGuz72UZ2c=; b=mJJtnKOBeJeZVRVOuIUnV vnOwn4/ZyPHM4ncZrUdGT9frAENhzLo2qliz2ZK+SCqfNKNlodlloEf9SFbnCXrF pEGOT9XmfcdwSbNjYLF4VIcUoHUV51NIWRe7EEuUGR2bcPnLMi+Tbn8EYDbZ91Z/ HQidZiqm17u8tjvuFc+6f0= Received: from leanderwang-LC2.localdomain (unknown [111.206.145.21]) by smtp3 (Coremail) with SMTP id G9xpCgB3hWhDLDFjxP8ngg--.49616S2; Mon, 26 Sep 2022 12:36:19 +0800 (CST) From: Zheng Wang To: dimitri.sivanich@hpe.com Cc: arnd@arndb.de, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org, hackerzheng666@gmail.com, alex000young@gmail.com, security@kernel.org, Zheng Wang Subject: [PATCH] misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os Date: Mon, 26 Sep 2022 12:36:18 +0800 Message-Id: <20220926043618.566326-1-zyytlz.wz@163.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: G9xpCgB3hWhDLDFjxP8ngg--.49616S2 X-Coremail-Antispam: 1Uf129KBjvJXoWxGr4xtF4UKw1fZr4DuFyfWFg_yoWrCF45pa 12g348ArW3XF4rurs7ta1kWFW3Ca48JFW5Cr9rtwnY9w4FyFs8GryDJas0qr4DurW0qr4a yF45tFnI9an0gaUanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x0zROtxDUUUUU= X-Originating-IP: [111.206.145.21] X-CM-SenderInfo: h2113zf2oz6qqrwthudrp/1tbiXAOIU1Xl4SnSDwAAsh Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Gts may be freed in gru_check_chiplet_assignment. The caller still use it after that, UAF happens. Fix it by introducing a return value to see if it's in error path or not.=20 Free the gts in caller if gru_check_chiplet_assignment check failed. Reported-by: Zheng Wang Signed-off-by: Zheng Wang --- drivers/misc/sgi-gru/grufault.c | 14 ++++++++++++-- drivers/misc/sgi-gru/grumain.c | 17 +++++++++++++---- drivers/misc/sgi-gru/grutables.h | 2 +- 3 files changed, 26 insertions(+), 7 deletions(-) diff --git a/drivers/misc/sgi-gru/grufault.c b/drivers/misc/sgi-gru/grufaul= t.c index d7ef61e602ed..2b5b049fbd38 100644 --- a/drivers/misc/sgi-gru/grufault.c +++ b/drivers/misc/sgi-gru/grufault.c @@ -656,7 +656,9 @@ int gru_handle_user_call_os(unsigned long cb) if (ucbnum >=3D gts->ts_cbr_au_count * GRU_CBR_AU_SIZE) goto exit; =20 - gru_check_context_placement(gts); + ret =3D gru_check_context_placement(gts); + if (ret) + goto err; =20 /* * CCH may contain stale data if ts_force_cch_reload is set. @@ -677,6 +679,10 @@ int gru_handle_user_call_os(unsigned long cb) exit: gru_unlock_gts(gts); return ret; +err: + gru_unlock_gts(gts); + gru_unload_context(gts, 1); + return -EINVAL; } =20 /* @@ -874,7 +880,7 @@ int gru_set_context_option(unsigned long arg) } else { gts->ts_user_blade_id =3D req.val1; gts->ts_user_chiplet_id =3D req.val0; - gru_check_context_placement(gts); + ret =3D gru_check_context_placement(gts); } break; case sco_gseg_owner: @@ -889,6 +895,10 @@ int gru_set_context_option(unsigned long arg) ret =3D -EINVAL; } gru_unlock_gts(gts); + if (ret) { + gru_unload_context(gts, 1); + ret =3D -EINVAL; + } =20 return ret; } diff --git a/drivers/misc/sgi-gru/grumain.c b/drivers/misc/sgi-gru/grumain.c index 9afda47efbf2..79903cf7e706 100644 --- a/drivers/misc/sgi-gru/grumain.c +++ b/drivers/misc/sgi-gru/grumain.c @@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_sta= te *gru, * chiplet. Misassignment can occur if the process migrates to a different * blade or if the user changes the selected blade/chiplet. */ -void gru_check_context_placement(struct gru_thread_state *gts) +int gru_check_context_placement(struct gru_thread_state *gts) { struct gru_state *gru; + int ret =3D 0; =20 /* * If the current task is the context owner, verify that the @@ -727,14 +728,16 @@ void gru_check_context_placement(struct gru_thread_st= ate *gts) */ gru =3D gts->ts_gru; if (!gru || gts->ts_tgid_owner !=3D current->tgid) - return; + return ret; =20 if (!gru_check_chiplet_assignment(gru, gts)) { STAT(check_context_unload); - gru_unload_context(gts, 1); + ret =3D -EINVAL; } else if (gru_retarget_intr(gts)) { STAT(check_context_retarget_intr); } + + return ret; } =20 =20 @@ -919,6 +922,7 @@ vm_fault_t gru_fault(struct vm_fault *vmf) struct gru_thread_state *gts; unsigned long paddr, vaddr; unsigned long expires; + int ret; =20 vaddr =3D vmf->address; gru_dbg(grudev, "vma %p, vaddr 0x%lx (0x%lx)\n", @@ -934,7 +938,12 @@ vm_fault_t gru_fault(struct vm_fault *vmf) mutex_lock(>s->ts_ctxlock); preempt_disable(); =20 - gru_check_context_placement(gts); + ret =3D gru_check_context_placement(gts); + if (ret) { + mutex_unlock(>s->ts_ctxlock); + gru_unload_context(gts, 1); + return ret; + } =20 if (!gts->ts_gru) { STAT(load_user_context); diff --git a/drivers/misc/sgi-gru/grutables.h b/drivers/misc/sgi-gru/grutab= les.h index 5efc869fe59a..f4a5a787685f 100644 --- a/drivers/misc/sgi-gru/grutables.h +++ b/drivers/misc/sgi-gru/grutables.h @@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg); extern int gru_user_unload_context(unsigned long arg); extern int gru_get_exception_detail(unsigned long arg); extern int gru_set_context_option(unsigned long address); -extern void gru_check_context_placement(struct gru_thread_state *gts); +extern int gru_check_context_placement(struct gru_thread_state *gts); extern int gru_cpu_fault_map_id(void); extern struct vm_area_struct *gru_find_vma(unsigned long vaddr); extern void gru_flush_all_tlb(struct gru_state *gru); --=20 2.25.1