All of lore.kernel.org
 help / color / mirror / Atom feed
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Zheng Wang <zyytlz.wz@163.com>,
	zhi.a.wang@intel.com, alex000young@gmail.com,
	security@kernel.org, intel-gvt-dev@lists.freedesktop.org,
	tvrtko.ursulin@linux.intel.com, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	joonas.lahtinen@linux.intel.com, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, 1002992920@qq.com,
	airlied@gmail.com
Subject: Re: [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Tue, 20 Dec 2022 17:03:41 +0800	[thread overview]
Message-ID: <CAJedcCzD6Zc=ncxH5821OA=zL49bUFqD2hYT=TruU2AVt+_2hg@mail.gmail.com> (raw)
In-Reply-To: <20221220082255.GE30028@zhen-hp.sh.intel.com>

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年12月20日周二 16:25写道:
>
> On 2022.12.19 20:52:04 +0800, Zheng Wang wrote:
> > If intel_gvt_dma_map_guest_page failed, it will call
> >  ppgtt_invalidate_spt, which will finally free the spt. But the caller does
> >  not notice that, it will free spt again in error path.
> >
>
> It's not clear from this description which caller is actually wrong,
> better to clarify the problem in ppgtt_populate_spt_by_guest_entry() function.
>

Get it, will do in the next fix.


> >                                                  PAGE_SIZE, &dma_addr);
> > -             if (ret) {
> > -                     ppgtt_invalidate_spt(spt);
> > -                     return ret;
> > -             }
> > +             if (ret)
> > +                     goto err;
>
> I think it's fine to remove this and leave to upper caller, but again please
> describe the behavior change in commit message as well, e.g to fix the sanity
> of spt destroy that leaving previous invalidate and free of spt to caller function
> instead of within callee function.

Sorry for my bad habit. Will do in the next version.

> >               sub_se.val64 = se->val64;
> >
> >               /* Copy the PAT field from PDE. */
> > @@ -1231,6 +1229,47 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> >       ops->set_pfn(se, sub_spt->shadow_page.mfn);
> >       ppgtt_set_shadow_entry(spt, se, index);
> >       return 0;
> > +err:
> > +     /* Undone the existing mappings of DMA addr. */
> > +     for_each_present_shadow_entry(spt, &e, parent_index) {
>
> sub_spt? We're undoing what's mapped for sub_spt right?

Yes, will change it to sub_spt in the next version.

>
> > +             switch (e.type) {
> > +             case GTT_TYPE_PPGTT_PTE_4K_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 4K entry\n");
> > +                     ppgtt_invalidate_pte(spt, &e);
> > +                     break;
> > +             case GTT_TYPE_PPGTT_PTE_64K_ENTRY:
> > +                     /* We don't setup 64K shadow entry so far. */
> > +                     WARN(1, "suspicious 64K gtt entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_2M_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 2M entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_1G_ENTRY:
> > +                     WARN(1, "GVT doesn't support 1GB page\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PML4_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDP_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDE_ENTRY:
>
> I don't think this all entry type makes sense, as here we just split
> 2M entry for multiple 4K PTE entry.

I got it. I will leave the code for handling 4K PTE entry only.

>
> > +                     gvt_vdbg_mm("invalidate PMUL4/PDP/PDE entry\n");
> > +                     ret1 = ppgtt_invalidate_spt_by_shadow_entry(
> > +                                     spt->vgpu, &e);
> > +                     if (ret1) {
> > +                             gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
> > +                             spt, e.val64, e.type);
> > +                             goto free_spt;
> > +                     }
>
> for above reason, I don't think this is valid.

Got it.


Thanks for your carefully reviewing. I'll try to fix that in the coming patch.

Best regards,
Zheng Wang

WARNING: multiple messages have this Message-ID (diff)
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: alex000young@gmail.com, security@kernel.org,
	tvrtko.ursulin@linux.intel.com, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	1002992920@qq.com, Zheng Wang <zyytlz.wz@163.com>,
	intel-gvt-dev@lists.freedesktop.org, zhi.a.wang@intel.com
Subject: Re: [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Tue, 20 Dec 2022 17:03:41 +0800	[thread overview]
Message-ID: <CAJedcCzD6Zc=ncxH5821OA=zL49bUFqD2hYT=TruU2AVt+_2hg@mail.gmail.com> (raw)
In-Reply-To: <20221220082255.GE30028@zhen-hp.sh.intel.com>

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年12月20日周二 16:25写道:
>
> On 2022.12.19 20:52:04 +0800, Zheng Wang wrote:
> > If intel_gvt_dma_map_guest_page failed, it will call
> >  ppgtt_invalidate_spt, which will finally free the spt. But the caller does
> >  not notice that, it will free spt again in error path.
> >
>
> It's not clear from this description which caller is actually wrong,
> better to clarify the problem in ppgtt_populate_spt_by_guest_entry() function.
>

Get it, will do in the next fix.


> >                                                  PAGE_SIZE, &dma_addr);
> > -             if (ret) {
> > -                     ppgtt_invalidate_spt(spt);
> > -                     return ret;
> > -             }
> > +             if (ret)
> > +                     goto err;
>
> I think it's fine to remove this and leave to upper caller, but again please
> describe the behavior change in commit message as well, e.g to fix the sanity
> of spt destroy that leaving previous invalidate and free of spt to caller function
> instead of within callee function.

Sorry for my bad habit. Will do in the next version.

> >               sub_se.val64 = se->val64;
> >
> >               /* Copy the PAT field from PDE. */
> > @@ -1231,6 +1229,47 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> >       ops->set_pfn(se, sub_spt->shadow_page.mfn);
> >       ppgtt_set_shadow_entry(spt, se, index);
> >       return 0;
> > +err:
> > +     /* Undone the existing mappings of DMA addr. */
> > +     for_each_present_shadow_entry(spt, &e, parent_index) {
>
> sub_spt? We're undoing what's mapped for sub_spt right?

Yes, will change it to sub_spt in the next version.

>
> > +             switch (e.type) {
> > +             case GTT_TYPE_PPGTT_PTE_4K_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 4K entry\n");
> > +                     ppgtt_invalidate_pte(spt, &e);
> > +                     break;
> > +             case GTT_TYPE_PPGTT_PTE_64K_ENTRY:
> > +                     /* We don't setup 64K shadow entry so far. */
> > +                     WARN(1, "suspicious 64K gtt entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_2M_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 2M entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_1G_ENTRY:
> > +                     WARN(1, "GVT doesn't support 1GB page\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PML4_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDP_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDE_ENTRY:
>
> I don't think this all entry type makes sense, as here we just split
> 2M entry for multiple 4K PTE entry.

I got it. I will leave the code for handling 4K PTE entry only.

>
> > +                     gvt_vdbg_mm("invalidate PMUL4/PDP/PDE entry\n");
> > +                     ret1 = ppgtt_invalidate_spt_by_shadow_entry(
> > +                                     spt->vgpu, &e);
> > +                     if (ret1) {
> > +                             gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
> > +                             spt, e.val64, e.type);
> > +                             goto free_spt;
> > +                     }
>
> for above reason, I don't think this is valid.

Got it.


Thanks for your carefully reviewing. I'll try to fix that in the coming patch.

Best regards,
Zheng Wang

WARNING: multiple messages have this Message-ID (diff)
From: Zheng Hacker <hackerzheng666@gmail.com>
To: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: alex000young@gmail.com, security@kernel.org, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
	1002992920@qq.com, airlied@gmail.com,
	Zheng Wang <zyytlz.wz@163.com>,
	intel-gvt-dev@lists.freedesktop.org
Subject: Re: [Intel-gfx] [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Tue, 20 Dec 2022 17:03:41 +0800	[thread overview]
Message-ID: <CAJedcCzD6Zc=ncxH5821OA=zL49bUFqD2hYT=TruU2AVt+_2hg@mail.gmail.com> (raw)
In-Reply-To: <20221220082255.GE30028@zhen-hp.sh.intel.com>

Zhenyu Wang <zhenyuw@linux.intel.com> 于2022年12月20日周二 16:25写道:
>
> On 2022.12.19 20:52:04 +0800, Zheng Wang wrote:
> > If intel_gvt_dma_map_guest_page failed, it will call
> >  ppgtt_invalidate_spt, which will finally free the spt. But the caller does
> >  not notice that, it will free spt again in error path.
> >
>
> It's not clear from this description which caller is actually wrong,
> better to clarify the problem in ppgtt_populate_spt_by_guest_entry() function.
>

Get it, will do in the next fix.


> >                                                  PAGE_SIZE, &dma_addr);
> > -             if (ret) {
> > -                     ppgtt_invalidate_spt(spt);
> > -                     return ret;
> > -             }
> > +             if (ret)
> > +                     goto err;
>
> I think it's fine to remove this and leave to upper caller, but again please
> describe the behavior change in commit message as well, e.g to fix the sanity
> of spt destroy that leaving previous invalidate and free of spt to caller function
> instead of within callee function.

Sorry for my bad habit. Will do in the next version.

> >               sub_se.val64 = se->val64;
> >
> >               /* Copy the PAT field from PDE. */
> > @@ -1231,6 +1229,47 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
> >       ops->set_pfn(se, sub_spt->shadow_page.mfn);
> >       ppgtt_set_shadow_entry(spt, se, index);
> >       return 0;
> > +err:
> > +     /* Undone the existing mappings of DMA addr. */
> > +     for_each_present_shadow_entry(spt, &e, parent_index) {
>
> sub_spt? We're undoing what's mapped for sub_spt right?

Yes, will change it to sub_spt in the next version.

>
> > +             switch (e.type) {
> > +             case GTT_TYPE_PPGTT_PTE_4K_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 4K entry\n");
> > +                     ppgtt_invalidate_pte(spt, &e);
> > +                     break;
> > +             case GTT_TYPE_PPGTT_PTE_64K_ENTRY:
> > +                     /* We don't setup 64K shadow entry so far. */
> > +                     WARN(1, "suspicious 64K gtt entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_2M_ENTRY:
> > +                     gvt_vdbg_mm("invalidate 2M entry\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PTE_1G_ENTRY:
> > +                     WARN(1, "GVT doesn't support 1GB page\n");
> > +                     continue;
> > +             case GTT_TYPE_PPGTT_PML4_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDP_ENTRY:
> > +             case GTT_TYPE_PPGTT_PDE_ENTRY:
>
> I don't think this all entry type makes sense, as here we just split
> 2M entry for multiple 4K PTE entry.

I got it. I will leave the code for handling 4K PTE entry only.

>
> > +                     gvt_vdbg_mm("invalidate PMUL4/PDP/PDE entry\n");
> > +                     ret1 = ppgtt_invalidate_spt_by_shadow_entry(
> > +                                     spt->vgpu, &e);
> > +                     if (ret1) {
> > +                             gvt_vgpu_err("fail: shadow page %p shadow entry 0x%llx type %d\n",
> > +                             spt, e.val64, e.type);
> > +                             goto free_spt;
> > +                     }
>
> for above reason, I don't think this is valid.

Got it.


Thanks for your carefully reviewing. I'll try to fix that in the coming patch.

Best regards,
Zheng Wang

  reply	other threads:[~2022-12-20  9:04 UTC|newest]

Thread overview: 93+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-09-18 19:24 [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Wang
2022-09-18 19:24 ` [Intel-gfx] " Zheng Wang
2022-09-19  9:30 ` Jani Nikula
2022-09-19  9:30   ` [Intel-gfx] " Jani Nikula
2022-09-19  9:55   ` Zheng Hacker
2022-09-19  9:55     ` [Intel-gfx] " Zheng Hacker
2022-09-19  9:55     ` Zheng Hacker
2022-09-21  9:13   ` Zheng Hacker
2022-09-21  9:13     ` [Intel-gfx] " Zheng Hacker
2022-09-21  9:13     ` Zheng Hacker
2022-09-28  3:33     ` [PATCH] drm/i915/gvt: fix double free " Zheng Wang
2022-09-28  3:33       ` [Intel-gfx] " Zheng Wang
2022-09-28  3:33       ` Zheng Wang
2022-10-02 14:18       ` Greg KH
2022-10-02 14:18         ` [Intel-gfx] " Greg KH
2022-10-02 14:18         ` Greg KH
2022-10-03  4:36         ` Zheng Hacker
2022-10-03  4:36           ` [Intel-gfx] " Zheng Hacker
2022-10-03  4:36           ` Zheng Hacker
2022-10-06 16:58       ` [PATCH v2] " Zheng Wang
2022-10-06 16:58         ` [Intel-gfx] " Zheng Wang
2022-10-06 16:58         ` Zheng Wang
2022-10-06 19:23         ` Greg KH
2022-10-06 19:23           ` [Intel-gfx] " Greg KH
2022-10-06 19:23           ` Greg KH
2022-10-07  0:39           ` Zheng Hacker
2022-10-07  0:39             ` [Intel-gfx] " Zheng Hacker
2022-10-07  0:39             ` Zheng Hacker
2022-10-07  1:37           ` [PATCH v3] " Zheng Wang
2022-10-07  1:37             ` [Intel-gfx] " Zheng Wang
2022-10-07  1:37             ` Zheng Wang
2022-10-27  0:01             ` [Intel-gfx] " Dave Airlie
2022-10-27  0:01               ` Dave Airlie
2022-10-27  0:01               ` Dave Airlie
2022-10-27  3:26               ` Zheng Hacker
2022-10-27  3:26                 ` [Intel-gfx] " Zheng Hacker
2022-10-27  3:26                 ` Zheng Hacker
2022-10-27  5:12                 ` Dave Airlie
2022-10-27  5:12                   ` [Intel-gfx] " Dave Airlie
2022-10-27  5:12                   ` Dave Airlie
2022-10-30 15:10                   ` Zheng Hacker
2022-10-30 15:10                     ` [Intel-gfx] " Zheng Hacker
2022-10-30 15:10                     ` Zheng Hacker
2022-12-15 10:47                   ` Joonas Lahtinen
2022-12-15 10:47                     ` [Intel-gfx] " Joonas Lahtinen
2022-12-15 11:33                     ` Wang, Zhi A
2022-12-15 11:33                       ` [Intel-gfx] " Wang, Zhi A
2022-12-15 13:26                       ` Zheng Hacker
2022-12-15 13:26                         ` [Intel-gfx] " Zheng Hacker
2022-12-15 13:26                         ` Zheng Hacker
2022-12-19  7:57                       ` [Intel-gfx] " Zheng Wang
2022-12-19  7:57                         ` Zheng Wang
2022-12-19  7:57                         ` Zheng Wang
2022-12-19  8:22                         ` Wang, Zhi A
2022-12-19  8:22                           ` Wang, Zhi A
2022-12-19  8:22                           ` Wang, Zhi A
2022-12-19  9:21                           ` Zheng Wang
2022-12-19  9:21                             ` Zheng Wang
2022-12-19  9:21                             ` Zheng Wang
2022-12-19 12:46                           ` [PATCH v4] [PATCH v4] " Zheng Wang
2022-12-19 12:46                             ` [Intel-gfx] " Zheng Wang
2022-12-19 12:46                             ` Zheng Wang
2022-12-19 12:52                           ` [RESEND PATCH " Zheng Wang
2022-12-19 12:52                             ` [Intel-gfx] " Zheng Wang
2022-12-19 12:52                             ` Zheng Wang
2022-12-20  8:22                             ` Zhenyu Wang
2022-12-20  8:22                               ` [Intel-gfx] " Zhenyu Wang
2022-12-20  8:22                               ` Zhenyu Wang
2022-12-20  9:03                               ` Zheng Hacker [this message]
2022-12-20  9:03                                 ` [Intel-gfx] " Zheng Hacker
2022-12-20  9:03                                 ` Zheng Hacker
2022-12-20  9:40                           ` [PATCH v5] " Zheng Wang
2022-12-20  9:40                             ` [Intel-gfx] " Zheng Wang
2022-12-20  9:40                             ` Zheng Wang
2022-12-21  2:58                             ` Zhenyu Wang
2022-12-21  2:58                               ` [Intel-gfx] " Zhenyu Wang
2022-12-21  2:58                               ` Zhenyu Wang
2022-12-21  5:01                               ` Zheng Hacker
2022-12-21  5:01                                 ` [Intel-gfx] " Zheng Hacker
2022-12-21  5:01                                 ` Zheng Hacker
2022-12-29 16:56                           ` [PATCH v6] " Zheng Wang
2022-12-29 16:56                             ` [Intel-gfx] " Zheng Wang
2022-12-29 16:56                             ` Zheng Wang
2022-09-19 20:17 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev2) Patchwork
2022-09-29 18:16 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev3) Patchwork
2022-09-29 18:40 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2022-09-30 18:41 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
2022-10-10 15:00 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev5) Patchwork
2022-10-10 15:30 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
2022-12-22 12:25 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev8) Patchwork
2022-12-22 12:53 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2022-12-22 18:13 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
2022-12-29 17:57 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev9) Patchwork

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAJedcCzD6Zc=ncxH5821OA=zL49bUFqD2hYT=TruU2AVt+_2hg@mail.gmail.com' \
    --to=hackerzheng666@gmail.com \
    --cc=1002992920@qq.com \
    --cc=airlied@gmail.com \
    --cc=airlied@linux.ie \
    --cc=alex000young@gmail.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=intel-gvt-dev@lists.freedesktop.org \
    --cc=joonas.lahtinen@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=security@kernel.org \
    --cc=tvrtko.ursulin@linux.intel.com \
    --cc=zhenyuw@linux.intel.com \
    --cc=zhi.a.wang@intel.com \
    --cc=zyytlz.wz@163.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.