Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f99d5f1b authored by Zheng Wang's avatar Zheng Wang Committed by Greg Kroah-Hartman
Browse files

misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault... 


misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os

[ Upstream commit 643a16a0eb1d6ac23744bb6e90a00fc21148a9dc ]

In some bad situation, the gts may be freed gru_check_chiplet_assignment.
The call chain can be gru_unload_context->gru_free_gru_context->gts_drop
and kfree finally. However, the caller didn't know if the gts is freed
or not and use it afterwards. This will trigger a Use after Free bug.

Fix it by introducing a return value to see if it's in error path or not.
Free the gts in caller if gru_check_chiplet_assignment check failed.

Fixes: 55484c45 ("gru: allow users to specify gru chiplet 2")
Signed-off-by: default avatarZheng Wang <zyytlz.wz@163.com>
Acked-by: default avatarDimitri Sivanich <sivanich@hpe.com>
Link: https://lore.kernel.org/r/20221110035033.19498-1-zyytlz.wz@163.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 2bbb222a

drivers/misc/sgi-gru/grufault.c

+11 −2
Original line number Original line Diff line number Diff line
@@ -656,6 +656,7 @@ int gru_handle_user_call_os(unsigned long cb) 
	if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)

	if ((cb & (GRU_HANDLE_STRIDE - 1)) || ucbnum >= GRU_NUM_CB)

		return -EINVAL;

		return -EINVAL;





again:

	gts = gru_find_lock_gts(cb);

	gts = gru_find_lock_gts(cb);

	if (!gts)

	if (!gts)

		return -EINVAL;

		return -EINVAL;
@@ -664,7 +665,11 @@ int gru_handle_user_call_os(unsigned long cb) 
	if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)

	if (ucbnum >= gts->ts_cbr_au_count * GRU_CBR_AU_SIZE)

		goto exit;

		goto exit;





	gru_check_context_placement(gts);

	if (gru_check_context_placement(gts)) {

		gru_unlock_gts(gts);

		gru_unload_context(gts, 1);

		goto again;

	}





	/*

	/*

	 * CCH may contain stale data if ts_force_cch_reload is set.

	 * CCH may contain stale data if ts_force_cch_reload is set.
@@ -882,7 +887,11 @@ int gru_set_context_option(unsigned long arg) 
		} else {

		} else {

			gts->ts_user_blade_id = req.val1;

			gts->ts_user_blade_id = req.val1;

			gts->ts_user_chiplet_id = req.val0;

			gts->ts_user_chiplet_id = req.val0;

			gru_check_context_placement(gts);

			if (gru_check_context_placement(gts)) {

				gru_unlock_gts(gts);

				gru_unload_context(gts, 1);

				return ret;

			}

		}

		}

		break;

		break;

	case sco_gseg_owner:

	case sco_gseg_owner:

drivers/misc/sgi-gru/grumain.c

+18 −4
Original line number Original line Diff line number Diff line
@@ -729,9 +729,10 @@ static int gru_check_chiplet_assignment(struct gru_state *gru, 
 * chiplet. Misassignment can occur if the process migrates to a different

 * chiplet. Misassignment can occur if the process migrates to a different

 * blade or if the user changes the selected blade/chiplet.

 * blade or if the user changes the selected blade/chiplet.

 */

 */

void gru_check_context_placement(struct gru_thread_state *gts)

int gru_check_context_placement(struct gru_thread_state *gts)

{

{

	struct gru_state *gru;

	struct gru_state *gru;

	int ret = 0;





	/*

	/*

	 * If the current task is the context owner, verify that the

	 * If the current task is the context owner, verify that the
@@ -739,15 +740,23 @@ void gru_check_context_placement(struct gru_thread_state *gts) 
	 * references. Pthread apps use non-owner references to the CBRs.

	 * references. Pthread apps use non-owner references to the CBRs.

	 */

	 */

	gru = gts->ts_gru;

	gru = gts->ts_gru;

	/*

	 * If gru or gts->ts_tgid_owner isn't initialized properly, return

	 * success to indicate that the caller does not need to unload the

	 * gru context.The caller is responsible for their inspection and

	 * reinitialization if needed.

	 */

	if (!gru || gts->ts_tgid_owner != current->tgid)

	if (!gru || gts->ts_tgid_owner != current->tgid)

		return;

		return ret;





	if (!gru_check_chiplet_assignment(gru, gts)) {

	if (!gru_check_chiplet_assignment(gru, gts)) {

		STAT(check_context_unload);

		STAT(check_context_unload);

		gru_unload_context(gts, 1);

		ret = -EINVAL;

	} else if (gru_retarget_intr(gts)) {

	} else if (gru_retarget_intr(gts)) {

		STAT(check_context_retarget_intr);

		STAT(check_context_retarget_intr);

	}

	}



	return ret;

}

}
@@ -946,7 +955,12 @@ int gru_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 
	mutex_lock(&gts->ts_ctxlock);

	mutex_lock(&gts->ts_ctxlock);

	preempt_disable();

	preempt_disable();





	gru_check_context_placement(gts);

	if (gru_check_context_placement(gts)) {

		preempt_enable();

		mutex_unlock(&gts->ts_ctxlock);

		gru_unload_context(gts, 1);

		return VM_FAULT_NOPAGE;

	}





	if (!gts->ts_gru) {

	if (!gts->ts_gru) {

		STAT(load_user_context);

		STAT(load_user_context);

drivers/misc/sgi-gru/grutables.h

+1 −1
Original line number Original line Diff line number Diff line
@@ -651,7 +651,7 @@ extern int gru_user_flush_tlb(unsigned long arg); 
extern int gru_user_unload_context(unsigned long arg);

extern int gru_user_unload_context(unsigned long arg);

extern int gru_get_exception_detail(unsigned long arg);

extern int gru_get_exception_detail(unsigned long arg);

extern int gru_set_context_option(unsigned long address);

extern int gru_set_context_option(unsigned long address);

extern void gru_check_context_placement(struct gru_thread_state *gts);

extern int gru_check_context_placement(struct gru_thread_state *gts);

extern int gru_cpu_fault_map_id(void);

extern int gru_cpu_fault_map_id(void);

extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);

extern struct vm_area_struct *gru_find_vma(unsigned long vaddr);

extern void gru_flush_all_tlb(struct gru_state *gru);

extern void gru_flush_all_tlb(struct gru_state *gru);