From: "Wang, Zhi A" <zhi.a.wang@intel.com> To: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Dave Airlie <airlied@gmail.com>, Zheng Hacker <hackerzheng666@gmail.com>, Zhenyu Wang <zhenyuw@linux.intel.com>, Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: "alex000young@gmail.com" <alex000young@gmail.com>, "security@kernel.org" <security@kernel.org>, "airlied@linux.ie" <airlied@linux.ie>, "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>, "intel-gfx@lists.freedesktop.org" <intel-gfx@lists.freedesktop.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "dri-devel@lists.freedesktop.org" <dri-devel@lists.freedesktop.org>, "1002992920@qq.com" <1002992920@qq.com>, Zheng Wang <zyytlz.wz@163.com>, "intel-gvt-dev@lists.freedesktop.org" <intel-gvt-dev@lists.freedesktop.org> Subject: Re: [PATCH v3] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry Date: Thu, 15 Dec 2022 11:33:03 +0000 [thread overview] Message-ID: <da557524-02ff-2ac7-7960-6f710c2d41d6@intel.com> (raw) In-Reply-To: <167110126066.5360.11413014428644610672@jlahtine-mobl.ger.corp.intel.com> On 12/15/2022 12:47 PM, Joonas Lahtinen wrote: > (+ Tvrtko as FYI) > > Zhenyu, can you take a look at the patch ASAP. > > Regards, Joonas Thanks so much for the reminding and patch. Actually I don't think it is proper fix as: split_2MB_gtt_entry() is going to allocate a new spt structure, which is a PTE page to hold the mapping of the 2MB. It will map the sub 4k pages for DMA addrs, form them as PTE entries, write the entries into the new PTE page, and then link the page to the parent table entry so that the GPU can reach it. Now something wrong happens when mapping the sub 4K pages. What we need are 1) The existing mappings of DMA addr need to be un-done and 2) the newly allocated spt structure needs to be freed. These can be handle by ppgtt_invalidate_spt() which will handle the 1) and 2) based on the type of shadow page table, either recursively or not. i.e. in this case, it's a PTE page. I guess the code wrongly does 1) 2) on the parent page table when something error happens in DMA mapping . You can fix it by releasing the newly allocated spt in the error case and put a Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") in the patch comment. BTW: For sending the patches, you can take a look on "git send-email". It will promise the correct format and prevent quite some bumps. For email clients, if you feel mutt is hard to ramp up, you can try the Claws Mail. More information can be found in Documentation/process/email-clients.rst Thanks, Zhi. > > Quoting Dave Airlie (2022-10-27 08:12:31) >> On Thu, 27 Oct 2022 at 13:26, Zheng Hacker <hackerzheng666@gmail.com> wrote: >>> Dave Airlie <airlied@gmail.com> 于2022年10月27日周四 08:01写道: >>>> On Fri, 7 Oct 2022 at 11:38, Zheng Wang <zyytlz.wz@163.com> wrote: >>>>> If intel_gvt_dma_map_guest_page failed, it will call >>>>> ppgtt_invalidate_spt, which will finally free the spt. >>>>> But the caller does not notice that, it will free spt again in error path. >>>>> >>>>> Fix this by spliting invalidate and free in ppgtt_invalidate_spt. >>>>> Only free spt when in good case. >>>>> >>>>> Reported-by: Zheng Wang <hackerzheng666@gmail.com> >>>>> Signed-off-by: Zheng Wang <zyytlz.wz@163.com> >>>> Has this landed in a tree yet, since it's a possible CVE, might be >>>> good to merge it somewhere. >>>> >>>> Dave. >>>> >>> Hi Dave, >>> >>> This patched hasn't been merged yet. Could you please help with this? >> I'll add some more people who can probably look at it. >> >> Dave.
WARNING: multiple messages have this Message-ID (diff)
From: "Wang, Zhi A" <zhi.a.wang@intel.com> To: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Dave Airlie <airlied@gmail.com>, Zheng Hacker <hackerzheng666@gmail.com>, Zhenyu Wang <zhenyuw@linux.intel.com>, Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: "alex000young@gmail.com" <alex000young@gmail.com>, "security@kernel.org" <security@kernel.org>, "airlied@linux.ie" <airlied@linux.ie>, "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>, "intel-gfx@lists.freedesktop.org" <intel-gfx@lists.freedesktop.org>, "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, "dri-devel@lists.freedesktop.org" <dri-devel@lists.freedesktop.org>, "1002992920@qq.com" <1002992920@qq.com>, Zheng Wang <zyytlz.wz@163.com>, "intel-gvt-dev@lists.freedesktop.org" <intel-gvt-dev@lists.freedesktop.org> Subject: Re: [Intel-gfx] [PATCH v3] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry Date: Thu, 15 Dec 2022 11:33:03 +0000 [thread overview] Message-ID: <da557524-02ff-2ac7-7960-6f710c2d41d6@intel.com> (raw) In-Reply-To: <167110126066.5360.11413014428644610672@jlahtine-mobl.ger.corp.intel.com> On 12/15/2022 12:47 PM, Joonas Lahtinen wrote: > (+ Tvrtko as FYI) > > Zhenyu, can you take a look at the patch ASAP. > > Regards, Joonas Thanks so much for the reminding and patch. Actually I don't think it is proper fix as: split_2MB_gtt_entry() is going to allocate a new spt structure, which is a PTE page to hold the mapping of the 2MB. It will map the sub 4k pages for DMA addrs, form them as PTE entries, write the entries into the new PTE page, and then link the page to the parent table entry so that the GPU can reach it. Now something wrong happens when mapping the sub 4K pages. What we need are 1) The existing mappings of DMA addr need to be un-done and 2) the newly allocated spt structure needs to be freed. These can be handle by ppgtt_invalidate_spt() which will handle the 1) and 2) based on the type of shadow page table, either recursively or not. i.e. in this case, it's a PTE page. I guess the code wrongly does 1) 2) on the parent page table when something error happens in DMA mapping . You can fix it by releasing the newly allocated spt in the error case and put a Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") in the patch comment. BTW: For sending the patches, you can take a look on "git send-email". It will promise the correct format and prevent quite some bumps. For email clients, if you feel mutt is hard to ramp up, you can try the Claws Mail. More information can be found in Documentation/process/email-clients.rst Thanks, Zhi. > > Quoting Dave Airlie (2022-10-27 08:12:31) >> On Thu, 27 Oct 2022 at 13:26, Zheng Hacker <hackerzheng666@gmail.com> wrote: >>> Dave Airlie <airlied@gmail.com> 于2022年10月27日周四 08:01写道: >>>> On Fri, 7 Oct 2022 at 11:38, Zheng Wang <zyytlz.wz@163.com> wrote: >>>>> If intel_gvt_dma_map_guest_page failed, it will call >>>>> ppgtt_invalidate_spt, which will finally free the spt. >>>>> But the caller does not notice that, it will free spt again in error path. >>>>> >>>>> Fix this by spliting invalidate and free in ppgtt_invalidate_spt. >>>>> Only free spt when in good case. >>>>> >>>>> Reported-by: Zheng Wang <hackerzheng666@gmail.com> >>>>> Signed-off-by: Zheng Wang <zyytlz.wz@163.com> >>>> Has this landed in a tree yet, since it's a possible CVE, might be >>>> good to merge it somewhere. >>>> >>>> Dave. >>>> >>> Hi Dave, >>> >>> This patched hasn't been merged yet. Could you please help with this? >> I'll add some more people who can probably look at it. >> >> Dave.
next prev parent reply other threads:[~2022-12-15 11:34 UTC|newest] Thread overview: 93+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-09-18 19:24 [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Wang 2022-09-18 19:24 ` [Intel-gfx] " Zheng Wang 2022-09-19 9:30 ` Jani Nikula 2022-09-19 9:30 ` [Intel-gfx] " Jani Nikula 2022-09-19 9:55 ` Zheng Hacker 2022-09-19 9:55 ` [Intel-gfx] " Zheng Hacker 2022-09-19 9:55 ` Zheng Hacker 2022-09-21 9:13 ` Zheng Hacker 2022-09-21 9:13 ` [Intel-gfx] " Zheng Hacker 2022-09-21 9:13 ` Zheng Hacker 2022-09-28 3:33 ` [PATCH] drm/i915/gvt: fix double free " Zheng Wang 2022-09-28 3:33 ` [Intel-gfx] " Zheng Wang 2022-09-28 3:33 ` Zheng Wang 2022-10-02 14:18 ` Greg KH 2022-10-02 14:18 ` [Intel-gfx] " Greg KH 2022-10-02 14:18 ` Greg KH 2022-10-03 4:36 ` Zheng Hacker 2022-10-03 4:36 ` [Intel-gfx] " Zheng Hacker 2022-10-03 4:36 ` Zheng Hacker 2022-10-06 16:58 ` [PATCH v2] " Zheng Wang 2022-10-06 16:58 ` [Intel-gfx] " Zheng Wang 2022-10-06 16:58 ` Zheng Wang 2022-10-06 19:23 ` Greg KH 2022-10-06 19:23 ` [Intel-gfx] " Greg KH 2022-10-06 19:23 ` Greg KH 2022-10-07 0:39 ` Zheng Hacker 2022-10-07 0:39 ` [Intel-gfx] " Zheng Hacker 2022-10-07 0:39 ` Zheng Hacker 2022-10-07 1:37 ` [PATCH v3] " Zheng Wang 2022-10-07 1:37 ` [Intel-gfx] " Zheng Wang 2022-10-07 1:37 ` Zheng Wang 2022-10-27 0:01 ` [Intel-gfx] " Dave Airlie 2022-10-27 0:01 ` Dave Airlie 2022-10-27 0:01 ` Dave Airlie 2022-10-27 3:26 ` Zheng Hacker 2022-10-27 3:26 ` [Intel-gfx] " Zheng Hacker 2022-10-27 3:26 ` Zheng Hacker 2022-10-27 5:12 ` Dave Airlie 2022-10-27 5:12 ` [Intel-gfx] " Dave Airlie 2022-10-27 5:12 ` Dave Airlie 2022-10-30 15:10 ` Zheng Hacker 2022-10-30 15:10 ` [Intel-gfx] " Zheng Hacker 2022-10-30 15:10 ` Zheng Hacker 2022-12-15 10:47 ` Joonas Lahtinen 2022-12-15 10:47 ` [Intel-gfx] " Joonas Lahtinen 2022-12-15 11:33 ` Wang, Zhi A [this message] 2022-12-15 11:33 ` Wang, Zhi A 2022-12-15 13:26 ` Zheng Hacker 2022-12-15 13:26 ` [Intel-gfx] " Zheng Hacker 2022-12-15 13:26 ` Zheng Hacker 2022-12-19 7:57 ` [Intel-gfx] " Zheng Wang 2022-12-19 7:57 ` Zheng Wang 2022-12-19 7:57 ` Zheng Wang 2022-12-19 8:22 ` Wang, Zhi A 2022-12-19 8:22 ` Wang, Zhi A 2022-12-19 8:22 ` Wang, Zhi A 2022-12-19 9:21 ` Zheng Wang 2022-12-19 9:21 ` Zheng Wang 2022-12-19 9:21 ` Zheng Wang 2022-12-19 12:46 ` [PATCH v4] [PATCH v4] " Zheng Wang 2022-12-19 12:46 ` [Intel-gfx] " Zheng Wang 2022-12-19 12:46 ` Zheng Wang 2022-12-19 12:52 ` [RESEND PATCH " Zheng Wang 2022-12-19 12:52 ` [Intel-gfx] " Zheng Wang 2022-12-19 12:52 ` Zheng Wang 2022-12-20 8:22 ` Zhenyu Wang 2022-12-20 8:22 ` [Intel-gfx] " Zhenyu Wang 2022-12-20 8:22 ` Zhenyu Wang 2022-12-20 9:03 ` Zheng Hacker 2022-12-20 9:03 ` [Intel-gfx] " Zheng Hacker 2022-12-20 9:03 ` Zheng Hacker 2022-12-20 9:40 ` [PATCH v5] " Zheng Wang 2022-12-20 9:40 ` [Intel-gfx] " Zheng Wang 2022-12-20 9:40 ` Zheng Wang 2022-12-21 2:58 ` Zhenyu Wang 2022-12-21 2:58 ` [Intel-gfx] " Zhenyu Wang 2022-12-21 2:58 ` Zhenyu Wang 2022-12-21 5:01 ` Zheng Hacker 2022-12-21 5:01 ` [Intel-gfx] " Zheng Hacker 2022-12-21 5:01 ` Zheng Hacker 2022-12-29 16:56 ` [PATCH v6] " Zheng Wang 2022-12-29 16:56 ` [Intel-gfx] " Zheng Wang 2022-12-29 16:56 ` Zheng Wang 2022-09-19 20:17 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev2) Patchwork 2022-09-29 18:16 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev3) Patchwork 2022-09-29 18:40 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork 2022-09-30 18:41 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork 2022-10-10 15:00 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev5) Patchwork 2022-10-10 15:30 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork 2022-12-22 12:25 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev8) Patchwork 2022-12-22 12:53 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork 2022-12-22 18:13 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork 2022-12-29 17:57 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev9) Patchwork
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=da557524-02ff-2ac7-7960-6f710c2d41d6@intel.com \ --to=zhi.a.wang@intel.com \ --cc=1002992920@qq.com \ --cc=airlied@gmail.com \ --cc=airlied@linux.ie \ --cc=alex000young@gmail.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=gregkh@linuxfoundation.org \ --cc=hackerzheng666@gmail.com \ --cc=intel-gfx@lists.freedesktop.org \ --cc=intel-gvt-dev@lists.freedesktop.org \ --cc=joonas.lahtinen@linux.intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=security@kernel.org \ --cc=tvrtko.ursulin@linux.intel.com \ --cc=zhenyuw@linux.intel.com \ --cc=zyytlz.wz@163.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.