misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
In some bad situation, the gts may be freed gru_check_chiplet_assignment.
The call chain can be gru_unload_context->gru_free_gru_context->gts_drop
and kfree finally. However, the caller didn't know if the gts is freed
or not and use it afterwards. This will trigger a Use after Free bug.
Fix it by introducing a return value to see if it's in error path or not.
Free the gts in caller if gru_check_chiplet_assignment check failed.
Fixes: 55484c45db
("gru: allow users to specify gru chiplet 2")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Acked-by: Dimitri Sivanich <sivanich@hpe.com>
Link: https://lore.kernel.org/r/20221110035033.19498-1-zyytlz.wz@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
fd2c930cf6
commit
643a16a0eb
@ -648,6 +648,7 @@ int gru_handle_user_call_os(unsigned long cb)
|
||||
if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)
|
||||
return -EINVAL;
|
||||
|
||||
again:
|
||||
gts = gru_find_lock_gts(cb);
|
||||
if (!gts)
|
||||
return -EINVAL;
|
||||
@ -656,7 +657,11 @@ int gru_handle_user_call_os(unsigned long cb)
|
||||
if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)
|
||||
goto exit;
|
||||
|
||||
gru_check_context_placement(gts);
|
||||
if (gru_check_context_placement(gts)) {
|
||||
gru_unlock_gts(gts);
|
||||
gru_unload_context(gts, 1);
|
||||
goto again;
|
||||
}
|
||||
|
||||
/*
|
||||
* CCH may contain stale data if ts_force_cch_reload is set.
|
||||
@ -874,7 +879,11 @@ int gru_set_context_option(unsigned long arg)
|
||||
} else {
|
||||
gts->ts_user_blade_id = req.val1;
|
||||
gts->ts_user_chiplet_id = req.val0;
|
||||
gru_check_context_placement(gts);
|
||||
if (gru_check_context_placement(gts)) {
|
||||
gru_unlock_gts(gts);
|
||||
gru_unload_context(gts, 1);
|
||||
return ret;
|
||||
}
|
||||
}
|
||||
break;
|
||||
case sco_gseg_owner:
|
||||
|
@ -716,9 +716,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru,
|
||||
* chiplet. Misassignment can occur if the process migrates to a different
|
||||
* blade or if the user changes the selected blade/chiplet.
|
||||
*/
|
||||
void gru_check_context_placement(struct gru_thread_state *gts)
|
||||
int gru_check_context_placement(struct gru_thread_state *gts)
|
||||
{
|
||||
struct gru_state *gru;
|
||||
int ret = 0;
|
||||
|
||||
/*
|
||||
* If the current task is the context owner, verify that the
|
||||
@ -726,15 +727,23 @@ void gru_check_context_placement(struct gru_thread_state *gts)
|
||||
* references. Pthread apps use non-owner references to the CBRs.
|
||||
*/
|
||||
gru = gts->ts_gru;
|
||||
/*
|
||||
* If gru or gts->ts_tgid_owner isn't initialized properly, return
|
||||
* success to indicate that the caller does not need to unload the
|
||||
* gru context.The caller is responsible for their inspection and
|
||||
* reinitialization if needed.
|
||||
*/
|
||||
if (!gru || gts->ts_tgid_owner != current->tgid)
|
||||
return;
|
||||
return ret;
|
||||
|
||||
if (!gru_check_chiplet_assignment(gru, gts)) {
|
||||
STAT(check_context_unload);
|
||||
gru_unload_context(gts, 1);
|
||||
ret = -EINVAL;
|
||||
} else if (gru_retarget_intr(gts)) {
|
||||
STAT(check_context_retarget_intr);
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
@ -934,7 +943,12 @@ again:
|
||||
mutex_lock(>s->ts_ctxlock);
|
||||
preempt_disable();
|
||||
|
||||
gru_check_context_placement(gts);
|
||||
if (gru_check_context_placement(gts)) {
|
||||
preempt_enable();
|
||||
mutex_unlock(>s->ts_ctxlock);
|
||||
gru_unload_context(gts, 1);
|
||||
return VM_FAULT_NOPAGE;
|
||||
}
|
||||
|
||||
if (!gts->ts_gru) {
|
||||
STAT(load_user_context);
|
||||
|
@ -632,7 +632,7 @@ extern int gru_user_flush_tlb(unsigned long arg);
|
||||
extern int gru_user_unload_context(unsigned long arg);
|
||||
extern int gru_get_exception_detail(unsigned long arg);
|
||||
extern int gru_set_context_option(unsigned long address);
|
||||
extern void gru_check_context_placement(struct gru_thread_state *gts);
|
||||
extern int gru_check_context_placement(struct gru_thread_state *gts);
|
||||
extern int gru_cpu_fault_map_id(void);
|
||||
extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);
|
||||
extern void gru_flush_all_tlb(struct gru_state *gru);
|
||||
|
Loading…
Reference in New Issue
Block a user