All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alex Young <alex000young@gmail.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Zheng Hacker <hackerzheng666@gmail.com>,
	xmzyshypnc <1002992920@qq.com>,
	airlied@linux.ie, daniel@ffwll.ch, zhenyuw@linux.intel.com,
	zhi.a.wang@intel.com, jani.nikula@linux.intel.com,
	joonas.lahtinen@linux.intel.com, rodrigo.vivi@intel.com,
	tvrtko.ursulin@linux.intel.com,
	intel-gvt-dev@lists.freedesktop.org,
	intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, security@kernel.org
Subject: Re: [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.
Date: Mon, 5 Sep 2022 16:53:28 +0800	[thread overview]
Message-ID: <CAFC++j0_11fpgGaAdDsQUyTzCG8KU0cO1ufMYFzACWquJALuZg@mail.gmail.com> (raw)
In-Reply-To: <YxWtfjfpNsoPUrgh@kroah.com>

Thanks for your reply.

We think that when intel_gvt_dma_map_guest_page() fails,
ppgtt_invalidate_spt is called to handle this error.

If the ppgtt_invalidate_spt is successful to kfree the spt object,
then in the ppgtt_populate_spt function there  is no need to kfree the
spt again.

And if the ppgtt_invalidate_spt failed, then in the ppgtt_populate_spt
function there is need to kfree the spt for error handling.

This is our fix, if it's not right, we are glad to discuss with you.

Greg KH <gregkh@linuxfoundation.org> 于2022年9月5日周一 16:04写道:
>
> On Mon, Sep 05, 2022 at 03:46:09PM +0800, Zheng Hacker wrote:
> > I rewrote the letter. Hope it works.
> >
> > There is a double-free security bug in split_2MB_gtt_entry.
> >
> > Here is a calling chain :
> > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry.
> > If intel_gvt_dma_map_guest_page failed, it will call
> > ppgtt_invalidate_spt, which will finally call ppgtt_free_spt and
> > kfree(spt). But the caller does not notice that, and it will call
> > ppgtt_free_spt again in error path.
> >
> > Fix this by returning the result of ppgtt_invalidate_spt to split_2MB_gtt_entry.
> >
> > Signed-off-by: Zheng Wang
> >
> > ---
> >  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> > index ce0eb03709c3..9f14fded8c0c 100644
> > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> >                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
> >                                                    PAGE_SIZE, &dma_addr);
> >                 if (ret) {
> > -                       ppgtt_invalidate_spt(spt);
> > +                       ret = ppgtt_invalidate_spt(spt);
> >                         return ret;
>
> But now you just lost the original error, shouldn't this succeed even if
> intel_gvt_dma_map_guest_page() failed?
>
> And how are you causing intel_gvt_dma_map_guest_page() to fail in a real
> system?
>
> thanks,
>
> greg k-h

WARNING: multiple messages have this Message-ID (diff)
From: Alex Young <alex000young@gmail.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: tvrtko.ursulin@linux.intel.com, security@kernel.org,
	dri-devel@lists.freedesktop.org, airlied@linux.ie,
	intel-gfx@lists.freedesktop.org,
	Zheng Hacker <hackerzheng666@gmail.com>,
	linux-kernel@vger.kernel.org, xmzyshypnc <1002992920@qq.com>,
	rodrigo.vivi@intel.com, intel-gvt-dev@lists.freedesktop.org,
	zhi.a.wang@intel.com
Subject: Re: [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.
Date: Mon, 5 Sep 2022 16:53:28 +0800	[thread overview]
Message-ID: <CAFC++j0_11fpgGaAdDsQUyTzCG8KU0cO1ufMYFzACWquJALuZg@mail.gmail.com> (raw)
In-Reply-To: <YxWtfjfpNsoPUrgh@kroah.com>

Thanks for your reply.

We think that when intel_gvt_dma_map_guest_page() fails,
ppgtt_invalidate_spt is called to handle this error.

If the ppgtt_invalidate_spt is successful to kfree the spt object,
then in the ppgtt_populate_spt function there  is no need to kfree the
spt again.

And if the ppgtt_invalidate_spt failed, then in the ppgtt_populate_spt
function there is need to kfree the spt for error handling.

This is our fix, if it's not right, we are glad to discuss with you.

Greg KH <gregkh@linuxfoundation.org> 于2022年9月5日周一 16:04写道:
>
> On Mon, Sep 05, 2022 at 03:46:09PM +0800, Zheng Hacker wrote:
> > I rewrote the letter. Hope it works.
> >
> > There is a double-free security bug in split_2MB_gtt_entry.
> >
> > Here is a calling chain :
> > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry.
> > If intel_gvt_dma_map_guest_page failed, it will call
> > ppgtt_invalidate_spt, which will finally call ppgtt_free_spt and
> > kfree(spt). But the caller does not notice that, and it will call
> > ppgtt_free_spt again in error path.
> >
> > Fix this by returning the result of ppgtt_invalidate_spt to split_2MB_gtt_entry.
> >
> > Signed-off-by: Zheng Wang
> >
> > ---
> >  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> > index ce0eb03709c3..9f14fded8c0c 100644
> > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> >                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
> >                                                    PAGE_SIZE, &dma_addr);
> >                 if (ret) {
> > -                       ppgtt_invalidate_spt(spt);
> > +                       ret = ppgtt_invalidate_spt(spt);
> >                         return ret;
>
> But now you just lost the original error, shouldn't this succeed even if
> intel_gvt_dma_map_guest_page() failed?
>
> And how are you causing intel_gvt_dma_map_guest_page() to fail in a real
> system?
>
> thanks,
>
> greg k-h

  reply	other threads:[~2022-09-05  8:53 UTC|newest]

Thread overview: 68+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <tencent_E1BBF05904DFB73C478DCD592740AAE0780A@qq.com>
2022-09-05  4:47 ` [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Hacker
2022-09-05  4:47   ` [Intel-gfx] " Zheng Hacker
2022-09-05  6:11   ` Zheng Hacker
2022-09-05  6:11     ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:35   ` Zheng Hacker
2022-09-05  7:35     ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:35     ` Zheng Hacker
2022-09-05  7:46     ` Zheng Hacker
2022-09-05  7:46       ` [Intel-gfx] " Zheng Hacker
2022-09-05  7:46       ` Zheng Hacker
2022-09-05  8:04       ` Greg KH
2022-09-05  8:04         ` [Intel-gfx] " Greg KH
2022-09-05  8:04         ` Greg KH
2022-09-05  8:53         ` Alex Young [this message]
2022-09-05  8:53           ` Alex Young
2022-09-06 11:36         ` Zheng Hacker
2022-09-06 11:36           ` [Intel-gfx] " Zheng Hacker
2022-09-06 11:36           ` Zheng Hacker
2022-09-07  3:07           ` Zhenyu Wang
2022-09-07  3:07             ` [Intel-gfx] " Zhenyu Wang
2022-09-07  3:07             ` Zhenyu Wang
2022-09-07  6:47             ` Zheng Hacker
2022-09-07  6:47               ` [Intel-gfx] " Zheng Hacker
2022-09-07  6:47               ` Zheng Hacker
2022-09-08  9:09             ` Zheng Hacker
2022-09-08  9:09               ` [Intel-gfx] " Zheng Hacker
2022-09-08  9:09               ` Zheng Hacker
2022-09-08  9:19               ` Greg KH
2022-09-08  9:19                 ` [Intel-gfx] " Greg KH
2022-09-08  9:19                 ` Greg KH
2022-09-08 11:59                 ` Zheng Hacker
2022-09-08 11:59                   ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:39                   ` Zheng Hacker
2022-09-16  6:39                     ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:39                     ` Zheng Hacker
2022-09-16  6:40                     ` Zheng Hacker
2022-09-16  6:40                       ` [Intel-gfx] " Zheng Hacker
2022-09-16  6:40                       ` Zheng Hacker
2022-09-16  8:25                     ` Greg KH
2022-09-16  8:25                       ` [Intel-gfx] " Greg KH
2022-09-16  8:25                       ` Greg KH
2022-09-16 15:21                       ` Zheng Hacker
2022-09-16 15:21                         ` [Intel-gfx] " Zheng Hacker
2022-09-16 15:21                         ` Zheng Hacker
2022-09-16 15:54                       ` Zheng Hacker
2022-09-16 15:54                         ` [Intel-gfx] " Zheng Hacker
2022-09-16 15:54                         ` Zheng Hacker
2022-09-17  9:08                         ` Greg KH
2022-09-17  9:08                           ` [Intel-gfx] " Greg KH
2022-09-17  9:08                           ` Greg KH
2022-09-17  9:10                           ` Zheng Hacker
2022-09-17  9:10                             ` [Intel-gfx] " Zheng Hacker
2022-09-18 17:08                           ` =?gb18030?B?s68=?=
2022-09-18 17:08                             ` [Intel-gfx] " =?gb18030?B?s68=?=
2022-09-18 17:17                           ` Zheng Hacker
2022-09-18 17:17                             ` [Intel-gfx] " Zheng Hacker
2022-09-18 17:17                             ` Zheng Hacker
2022-09-19 20:16   ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for " Patchwork
2022-09-06 12:58 ` Patchwork
2022-09-06 14:22   ` Zheng Hacker
2022-09-06 14:29   ` Zheng Hacker
2022-09-19 20:20 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for ✗ Fi.CI.BUILD: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry. (rev3) Patchwork
2022-09-18 19:24 [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Wang
2022-09-19  9:30 ` Jani Nikula
2022-09-19  9:55   ` Zheng Hacker
2022-09-19  9:55     ` Zheng Hacker
2022-09-21  9:13   ` Zheng Hacker
2022-09-21  9:13     ` Zheng Hacker

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFC++j0_11fpgGaAdDsQUyTzCG8KU0cO1ufMYFzACWquJALuZg@mail.gmail.com \
    --to=alex000young@gmail.com \
    --cc=1002992920@qq.com \
    --cc=airlied@linux.ie \
    --cc=daniel@ffwll.ch \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hackerzheng666@gmail.com \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=intel-gvt-dev@lists.freedesktop.org \
    --cc=jani.nikula@linux.intel.com \
    --cc=joonas.lahtinen@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=rodrigo.vivi@intel.com \
    --cc=security@kernel.org \
    --cc=tvrtko.ursulin@linux.intel.com \
    --cc=zhenyuw@linux.intel.com \
    --cc=zhi.a.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.