From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com,
Arnd Bergmann <arnd@arndb.de>,
Charan Teja Reddy <charante@codeaurora.org>,
Sumit Semwal <sumit.semwal@linaro.org>
Subject: [PATCH 5.4 59/65] dma-buf: Move dma_buf_release() from fops to dentry_ops
Date: Tue, 7 Jul 2020 17:17:38 +0200 [thread overview]
Message-ID: <20200707145755.318431154@linuxfoundation.org> (raw)
In-Reply-To: <20200707145752.417212219@linuxfoundation.org>
From: Sumit Semwal <sumit.semwal@linaro.org>
commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream.
Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which
happens if the dma_buf_release() is called while the userspace is
accessing the dma_buf pseudo fs's dmabuffs_dname() in another process,
and dma_buf_release() releases the dmabuf object when the last reference
to the struct file goes away.
I discussed with Arnd Bergmann, and he suggested that rather than tying
the dma_buf_release() to the file_operations' release(), we can tie it to
the dentry_operations' d_release(), which will be called when the last ref
to the dentry is removed.
The path exercised by __fput() calls f_op->release() first, and then calls
dput, which eventually calls d_op->d_release().
In the 'normal' case, when no userspace access is happening via dma_buf
pseudo fs, there should be exactly one fd, file, dentry and inode, so
closing the fd will kill of everything right away.
In the presented case, the dentry's d_release() will be called only when
the dentry's last ref is released.
Therefore, lets move dma_buf_release() from fops->release() to
d_ops->d_release()
Many thanks to Arnd for his FS insights :)
[1]: https://lore.kernel.org/patchwork/patch/1238278/
Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls")
Reported-by: syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org> [5.3+]
Cc: Arnd Bergmann <arnd@arndb.de>
Reported-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Tested-by: Charan Teja Reddy <charante@codeaurora.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200611114418.19852-1-sumit.semwal@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/dma-buf.c | 54 +++++++++++++++++++++-------------------------
1 file changed, 25 insertions(+), 29 deletions(-)
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -54,37 +54,11 @@ static char *dmabuffs_dname(struct dentr
dentry->d_name.name, ret > 0 ? name : "");
}
-static const struct dentry_operations dma_buf_dentry_ops = {
- .d_dname = dmabuffs_dname,
-};
-
-static struct vfsmount *dma_buf_mnt;
-
-static int dma_buf_fs_init_context(struct fs_context *fc)
-{
- struct pseudo_fs_context *ctx;
-
- ctx = init_pseudo(fc, DMA_BUF_MAGIC);
- if (!ctx)
- return -ENOMEM;
- ctx->dops = &dma_buf_dentry_ops;
- return 0;
-}
-
-static struct file_system_type dma_buf_fs_type = {
- .name = "dmabuf",
- .init_fs_context = dma_buf_fs_init_context,
- .kill_sb = kill_anon_super,
-};
-
-static int dma_buf_release(struct inode *inode, struct file *file)
+static void dma_buf_release(struct dentry *dentry)
{
struct dma_buf *dmabuf;
- if (!is_dma_buf_file(file))
- return -EINVAL;
-
- dmabuf = file->private_data;
+ dmabuf = dentry->d_fsdata;
BUG_ON(dmabuf->vmapping_counter);
@@ -110,9 +84,32 @@ static int dma_buf_release(struct inode
module_put(dmabuf->owner);
kfree(dmabuf->name);
kfree(dmabuf);
+}
+
+static const struct dentry_operations dma_buf_dentry_ops = {
+ .d_dname = dmabuffs_dname,
+ .d_release = dma_buf_release,
+};
+
+static struct vfsmount *dma_buf_mnt;
+
+static int dma_buf_fs_init_context(struct fs_context *fc)
+{
+ struct pseudo_fs_context *ctx;
+
+ ctx = init_pseudo(fc, DMA_BUF_MAGIC);
+ if (!ctx)
+ return -ENOMEM;
+ ctx->dops = &dma_buf_dentry_ops;
return 0;
}
+static struct file_system_type dma_buf_fs_type = {
+ .name = "dmabuf",
+ .init_fs_context = dma_buf_fs_init_context,
+ .kill_sb = kill_anon_super,
+};
+
static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma)
{
struct dma_buf *dmabuf;
@@ -412,7 +409,6 @@ static void dma_buf_show_fdinfo(struct s
}
static const struct file_operations dma_buf_fops = {
- .release = dma_buf_release,
.mmap = dma_buf_mmap_internal,
.llseek = dma_buf_llseek,
.poll = dma_buf_poll,
next prev parent reply other threads:[~2020-07-07 15:22 UTC|newest]
Thread overview: 78+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-07 15:16 [PATCH 5.4 00/65] 5.4.51-rc1 review Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 01/65] io_uring: make sure async workqueue is canceled on exit Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 02/65] mm: fix swap cache node allocation mask Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 03/65] EDAC/amd64: Read back the scrub rate PCI register on F15h Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 04/65] usbnet: smsc95xx: Fix use-after-free after removal Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 05/65] sched/debug: Make sd->flags sysctl read-only Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 06/65] mm/slub.c: fix corrupted freechain in deactivate_slab() Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 07/65] mm/slub: fix stack overruns with SLUB_STATS Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 08/65] rxrpc: Fix race between incoming ACK parser and retransmitter Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 09/65] usb: usbtest: fix missing kfree(dev->buf) in usbtest_disconnect Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 10/65] tools lib traceevent: Add append() function helper for appending strings Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 11/65] tools lib traceevent: Handle __attribute__((user)) in field names Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 12/65] s390/debug: avoid kernel warning on too large number of pages Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 13/65] nvme-multipath: set bdi capabilities once Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 14/65] nvme: fix possible deadlock when I/O is blocked Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 15/65] nvme-multipath: fix deadlock between ana_work and scan_work Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 16/65] nvme-multipath: fix deadlock due to head->lock Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 17/65] nvme-multipath: fix bogus request queue reference put Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 18/65] kgdb: Avoid suspicious RCU usage warning Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 19/65] selftests: tpm: Use /bin/sh instead of /bin/bash Greg Kroah-Hartman
2020-07-07 15:16 ` [PATCH 5.4 20/65] tpm: Fix TIS locality timeout problems Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 21/65] crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 22/65] drm/msm/dpu: fix error return code in dpu_encoder_init Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 23/65] rxrpc: Fix afs large storage transmission performance drop Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 24/65] RDMA/counter: Query a counter before release Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 25/65] cxgb4: use unaligned conversion for fetching timestamp Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 26/65] cxgb4: parse TC-U32 key values and masks natively Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 27/65] cxgb4: fix endian conversions for L4 ports in filters Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 28/65] cxgb4: use correct type for all-mask IP address comparison Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 29/65] cxgb4: fix SGE queue dump destination buffer context Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 30/65] hwmon: (max6697) Make sure the OVERT mask is set correctly Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 31/65] hwmon: (acpi_power_meter) Fix potential memory leak in acpi_power_meter_add() Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 32/65] thermal/drivers/mediatek: Fix bank number settings on mt8183 Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 33/65] thermal/drivers/rcar_gen3: Fix undefined temperature if negative Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 34/65] kthread: save thread function Greg Kroah-Hartman
2020-07-07 15:31 ` J. Bruce Fields
2020-07-07 15:17 ` [PATCH 5.4 35/65] nfsd: clients dont need to break their own delegations Greg Kroah-Hartman
2020-07-07 15:31 ` J. Bruce Fields
2020-07-07 17:20 ` Sasha Levin
2020-07-07 17:29 ` Sasha Levin
2020-07-07 17:31 ` J. Bruce Fields
2020-07-07 15:17 ` [PATCH 5.4 36/65] nfsd4: fix nfsdfs reference count loop Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 37/65] nfsd: fix nfsdfs inode reference count leak Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 38/65] drm: sun4i: hdmi: Remove extra HPD polling Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 39/65] virtio-blk: free vblk-vqs in error path of virtblk_probe() Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 40/65] SMB3: Honor posix flag for multiuser mounts Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 41/65] nvme: fix identify error status silent ignore Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 42/65] nvme: fix a crash in nvme_mpath_add_disk Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 43/65] samples/vfs: avoid warning in statx override Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 44/65] i2c: algo-pca: Add 0x78 as SCL stuck low status for PCA9665 Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 45/65] i2c: mlxcpld: check correct size of maximum RECV_LEN packet Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 46/65] spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 47/65] nfsd: apply umask on fs without ACL support Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 48/65] Revert "ALSA: usb-audio: Improve frames size computation" Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 49/65] SMB3: Honor seal flag for multiuser mounts Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 50/65] SMB3: Honor persistent/resilient handle flags " Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 51/65] SMB3: Honor lease disabling " Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 52/65] SMB3: Honor handletimeout flag " Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 53/65] cifs: Fix the target file was deleted when rename failed Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 54/65] MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 55/65] MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 56/65] drm/amd/display: Only revalidate bandwidth on medium and fast updates Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 57/65] drm/amdgpu: use %u rather than %d for sclk/mclk Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 58/65] drm/amdgpu/atomfirmware: fix vram_info fetching for renoir Greg Kroah-Hartman
2020-07-07 15:17 ` Greg Kroah-Hartman [this message]
2020-07-07 15:17 ` [PATCH 5.4 60/65] irqchip/gic: Atomically update affinity Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 61/65] mm, compaction: fully assume capture is not NULL in compact_zone_order() Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 62/65] mm, compaction: make capture control handling safe wrt interrupts Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 63/65] x86/resctrl: Fix memory bandwidth counter width for AMD Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 64/65] dm zoned: assign max_io_len correctly Greg Kroah-Hartman
2020-07-07 15:17 ` [PATCH 5.4 65/65] efi: Make it possible to disable efivar_ssdt entirely Greg Kroah-Hartman
2020-07-08 5:30 ` [PATCH 5.4 00/65] 5.4.51-rc1 review Naresh Kamboju
2020-07-08 8:41 ` Jon Hunter
2020-07-08 15:15 ` Greg Kroah-Hartman
2020-07-08 16:58 ` Jon Hunter
2020-07-09 9:30 ` Greg Kroah-Hartman
2020-07-08 15:00 ` Shuah Khan
2020-07-08 17:53 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200707145755.318431154@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=arnd@arndb.de \
--cc=charante@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).