* [PATCH] mm/hmm/test: use after free in dmirror_allocate_chunk()
@ 2020-09-22 8:12 Dan Carpenter
2020-09-22 17:31 ` Ralph Campbell
0 siblings, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2020-09-22 8:12 UTC (permalink / raw)
To: Jérôme Glisse, Ralph Campbell
Cc: Jason Gunthorpe, Wei Yongjun, linux-mm, linux-kernel, kernel-janitors
The error handling code does this:
err_free:
kfree(devmem);
^^^^^^^^^^^^^
err_release:
release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
^^^^^^^^
The problem is that when we use "devmem->pagemap.range.start" the
"devmem" pointer is either NULL or freed.
Neither the allocation nor the call to request_free_mem_region() has to
be done under the lock so I moved those to the start of the function.
Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
It's weird that I didn't catch the use after free when this code was
merged in May... My bad. Not sure what happened there. How I found
this was that I have been reviewing release_mem_region() leaks and the
NULL dereference path is a leak.
lib/test_hmm.c | 47 ++++++++++++++++++++++++-----------------------
1 file changed, 24 insertions(+), 23 deletions(-)
diff --git a/lib/test_hmm.c b/lib/test_hmm.c
index c8133f50160b..0503c78cb322 100644
--- a/lib/test_hmm.c
+++ b/lib/test_hmm.c
@@ -459,6 +459,22 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
unsigned long pfn_last;
void *ptr;
+ devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
+ if (!devmem)
+ return -ENOMEM;
+
+ res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
+ "hmm_dmirror");
+ if (IS_ERR(res))
+ goto err_devmem;
+
+ devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
+ devmem->pagemap.range.start = res->start;
+ devmem->pagemap.range.end = res->end;
+ devmem->pagemap.nr_range = 1;
+ devmem->pagemap.ops = &dmirror_devmem_ops;
+ devmem->pagemap.owner = mdevice;
+
mutex_lock(&mdevice->devmem_lock);
if (mdevice->devmem_count == mdevice->devmem_capacity) {
@@ -471,30 +487,16 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
sizeof(new_chunks[0]) * new_capacity,
GFP_KERNEL);
if (!new_chunks)
- goto err;
+ goto err_release;
mdevice->devmem_capacity = new_capacity;
mdevice->devmem_chunks = new_chunks;
}
- res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
- "hmm_dmirror");
- if (IS_ERR(res))
- goto err;
-
- devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
- if (!devmem)
- goto err_release;
-
- devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
- devmem->pagemap.range.start = res->start;
- devmem->pagemap.range.end = res->end;
- devmem->pagemap.nr_range = 1;
- devmem->pagemap.ops = &dmirror_devmem_ops;
- devmem->pagemap.owner = mdevice;
-
ptr = memremap_pages(&devmem->pagemap, numa_node_id());
- if (IS_ERR(ptr))
- goto err_free;
+ if (IS_ERR(ptr)) {
+ mutex_unlock(&mdevice->devmem_lock);
+ goto err_release;
+ }
devmem->mdevice = mdevice;
pfn_first = devmem->pagemap.range.start >> PAGE_SHIFT;
@@ -525,12 +527,11 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
return true;
-err_free:
- kfree(devmem);
err_release:
release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
-err:
- mutex_unlock(&mdevice->devmem_lock);
+err_devmem:
+ kfree(devmem);
+
return false;
}
--
2.28.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] mm/hmm/test: use after free in dmirror_allocate_chunk()
2020-09-22 8:12 [PATCH] mm/hmm/test: use after free in dmirror_allocate_chunk() Dan Carpenter
@ 2020-09-22 17:31 ` Ralph Campbell
2020-09-24 13:46 ` [PATCH v2] " Dan Carpenter
2020-09-24 13:47 ` [PATCH] " Dan Carpenter
0 siblings, 2 replies; 6+ messages in thread
From: Ralph Campbell @ 2020-09-22 17:31 UTC (permalink / raw)
To: Dan Carpenter, Jérôme Glisse
Cc: Jason Gunthorpe, Wei Yongjun, linux-mm, linux-kernel, kernel-janitors
On 9/22/20 1:12 AM, Dan Carpenter wrote:
> The error handling code does this:
>
> err_free:
> kfree(devmem);
> ^^^^^^^^^^^^^
> err_release:
> release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
> ^^^^^^^^
> The problem is that when we use "devmem->pagemap.range.start" the
> "devmem" pointer is either NULL or freed.
>
> Neither the allocation nor the call to request_free_mem_region() has to
> be done under the lock so I moved those to the start of the function.
>
> Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> It's weird that I didn't catch the use after free when this code was
> merged in May... My bad. Not sure what happened there. How I found
> this was that I have been reviewing release_mem_region() leaks and the
> NULL dereference path is a leak.
>
Thanks for fixing this. I missed it too. :-)
> lib/test_hmm.c | 47 ++++++++++++++++++++++++-----------------------
> 1 file changed, 24 insertions(+), 23 deletions(-)
>
> diff --git a/lib/test_hmm.c b/lib/test_hmm.c
> index c8133f50160b..0503c78cb322 100644
> --- a/lib/test_hmm.c
> +++ b/lib/test_hmm.c
> @@ -459,6 +459,22 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
> unsigned long pfn_last;
> void *ptr;
>
> + devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
> + if (!devmem)
> + return -ENOMEM;
> +
> + res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
> + "hmm_dmirror");
> + if (IS_ERR(res))
> + goto err_devmem;
> +
> + devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
> + devmem->pagemap.range.start = res->start;
> + devmem->pagemap.range.end = res->end;
> + devmem->pagemap.nr_range = 1;
> + devmem->pagemap.ops = &dmirror_devmem_ops;
> + devmem->pagemap.owner = mdevice;
> +
> mutex_lock(&mdevice->devmem_lock);
>
> if (mdevice->devmem_count == mdevice->devmem_capacity) {
> @@ -471,30 +487,16 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
> sizeof(new_chunks[0]) * new_capacity,
> GFP_KERNEL);
> if (!new_chunks)
Need to call mutex_unlock(&mdevice->devmem_lock).
In fact, why not make this goto err_unlock and add
err_unlock: mutex_unlock() before the err_release:.
> - goto err;
> + goto err_release;> mdevice->devmem_capacity = new_capacity;
> mdevice->devmem_chunks = new_chunks;
> }
>
> - res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
> - "hmm_dmirror");
> - if (IS_ERR(res))
> - goto err;
> -
> - devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
> - if (!devmem)
> - goto err_release;
> -
> - devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
> - devmem->pagemap.range.start = res->start;
> - devmem->pagemap.range.end = res->end;
> - devmem->pagemap.nr_range = 1;
> - devmem->pagemap.ops = &dmirror_devmem_ops;
> - devmem->pagemap.owner = mdevice;
> -
> ptr = memremap_pages(&devmem->pagemap, numa_node_id());
> - if (IS_ERR(ptr))
> - goto err_free;
> + if (IS_ERR(ptr)) {
> + mutex_unlock(&mdevice->devmem_lock);
> + goto err_release;
> + }
This could then be just goto err_unlock.
> devmem->mdevice = mdevice;
> pfn_first = devmem->pagemap.range.start >> PAGE_SHIFT;
> @@ -525,12 +527,11 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
>
> return true;
>
> -err_free:
> - kfree(devmem);
> err_release:
> release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
> -err:
> - mutex_unlock(&mdevice->devmem_lock);
> +err_devmem:
> + kfree(devmem);
> +
> return false;
> }
>
With the suggested change, you can add
Reviewed-by: Ralph Campbell <rcampbell@nvidia.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] mm/hmm/test: use after free in dmirror_allocate_chunk()
2020-09-22 17:31 ` Ralph Campbell
@ 2020-09-24 13:46 ` Dan Carpenter
2020-09-24 19:25 ` Ralph Campbell
2020-09-24 13:47 ` [PATCH] " Dan Carpenter
1 sibling, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2020-09-24 13:46 UTC (permalink / raw)
To: Jérôme Glisse
Cc: Wei Yongjun, Jason Gunthorpe, Ralph Campbell, linux-mm,
linux-kernel, kernel-janitors
The error handling code does this:
err_free:
kfree(devmem);
^^^^^^^^^^^^^
err_release:
release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
^^^^^^^^
The problem is that when we use "devmem->pagemap.range.start" the
"devmem" pointer is either NULL or freed.
Neither the allocation nor the call to request_free_mem_region() has to
be done under the lock so I moved those to the start of the function.
Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: The first version introduced a locking bug
lib/test_hmm.c | 44 ++++++++++++++++++++++----------------------
1 file changed, 22 insertions(+), 22 deletions(-)
diff --git a/lib/test_hmm.c b/lib/test_hmm.c
index c8133f50160b..e151a7f10519 100644
--- a/lib/test_hmm.c
+++ b/lib/test_hmm.c
@@ -459,6 +459,22 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
unsigned long pfn_last;
void *ptr;
+ devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
+ if (!devmem)
+ return -ENOMEM;
+
+ res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
+ "hmm_dmirror");
+ if (IS_ERR(res))
+ goto err_devmem;
+
+ devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
+ devmem->pagemap.range.start = res->start;
+ devmem->pagemap.range.end = res->end;
+ devmem->pagemap.nr_range = 1;
+ devmem->pagemap.ops = &dmirror_devmem_ops;
+ devmem->pagemap.owner = mdevice;
+
mutex_lock(&mdevice->devmem_lock);
if (mdevice->devmem_count == mdevice->devmem_capacity) {
@@ -471,30 +487,14 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
sizeof(new_chunks[0]) * new_capacity,
GFP_KERNEL);
if (!new_chunks)
- goto err;
+ goto err_release;
mdevice->devmem_capacity = new_capacity;
mdevice->devmem_chunks = new_chunks;
}
- res = request_free_mem_region(&iomem_resource, DEVMEM_CHUNK_SIZE,
- "hmm_dmirror");
- if (IS_ERR(res))
- goto err;
-
- devmem = kzalloc(sizeof(*devmem), GFP_KERNEL);
- if (!devmem)
- goto err_release;
-
- devmem->pagemap.type = MEMORY_DEVICE_PRIVATE;
- devmem->pagemap.range.start = res->start;
- devmem->pagemap.range.end = res->end;
- devmem->pagemap.nr_range = 1;
- devmem->pagemap.ops = &dmirror_devmem_ops;
- devmem->pagemap.owner = mdevice;
-
ptr = memremap_pages(&devmem->pagemap, numa_node_id());
if (IS_ERR(ptr))
- goto err_free;
+ goto err_release;
devmem->mdevice = mdevice;
pfn_first = devmem->pagemap.range.start >> PAGE_SHIFT;
@@ -525,12 +525,12 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
return true;
-err_free:
- kfree(devmem);
err_release:
- release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
-err:
mutex_unlock(&mdevice->devmem_lock);
+ release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
+err_devmem:
+ kfree(devmem);
+
return false;
}
--
2.28.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] mm/hmm/test: use after free in dmirror_allocate_chunk()
2020-09-22 17:31 ` Ralph Campbell
2020-09-24 13:46 ` [PATCH v2] " Dan Carpenter
@ 2020-09-24 13:47 ` Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2020-09-24 13:47 UTC (permalink / raw)
To: Ralph Campbell
Cc: Jérôme Glisse, Jason Gunthorpe, Wei Yongjun, linux-mm,
linux-kernel, kernel-janitors
On Tue, Sep 22, 2020 at 10:31:01AM -0700, Ralph Campbell wrote:
> > @@ -471,30 +487,16 @@ static bool dmirror_allocate_chunk(struct dmirror_device *mdevice,
> > sizeof(new_chunks[0]) * new_capacity,
> > GFP_KERNEL);
> > if (!new_chunks)
>
> Need to call mutex_unlock(&mdevice->devmem_lock).
> In fact, why not make this goto err_unlock and add
> err_unlock: mutex_unlock() before the err_release:.
Ugh... Thanks for catching that.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mm/hmm/test: use after free in dmirror_allocate_chunk()
2020-09-24 13:46 ` [PATCH v2] " Dan Carpenter
@ 2020-09-24 19:25 ` Ralph Campbell
0 siblings, 0 replies; 6+ messages in thread
From: Ralph Campbell @ 2020-09-24 19:25 UTC (permalink / raw)
To: Dan Carpenter, Jérôme Glisse
Cc: Wei Yongjun, Jason Gunthorpe, linux-mm, linux-kernel, kernel-janitors
On 9/24/20 6:46 AM, Dan Carpenter wrote:
> The error handling code does this:
>
> err_free:
> kfree(devmem);
> ^^^^^^^^^^^^^
> err_release:
> release_mem_region(devmem->pagemap.range.start, range_len(&devmem->pagemap.range));
> ^^^^^^^^
> The problem is that when we use "devmem->pagemap.range.start" the
> "devmem" pointer is either NULL or freed.
>
> Neither the allocation nor the call to request_free_mem_region() has to
> be done under the lock so I moved those to the start of the function.
>
> Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Looks good.
Reviewed-by: Ralph Campbell <rcampbell@nvidia.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] mm/hmm/test: use after free in dmirror_allocate_chunk()
@ 2020-09-25 19:30 Markus Elfring
0 siblings, 0 replies; 6+ messages in thread
From: Markus Elfring @ 2020-09-25 19:30 UTC (permalink / raw)
To: Dan Carpenter, linux-mm, Andrew Morton, Stephen Rothwell, Dan Williams
Cc: kernel-janitors, linux-kernel, Andy Lutomirski, Ard Biesheuvel,
Ben Skeggs, Benjamin Herrenschmidt, Borislav Petkov,
Brice Goglin, Catalin Marinas, Daniel Vetter, Dave Hansen,
Dave Jiang, David Airlie, David Hildenbrand, Greg Kroah-Hartman,
H. Peter Anvin, Ingo Molnar, Ira Weiny, Jason Gunthorpe,
Jason Gunthorpe, Jeff Moyer, Jérôme Glisse, Jia He,
Joao Martins, Jonathan Cameron, Michael Ellerman, Mike Rapoport,
Paul Mackerras, Pavel Tatashin, Peter Zijlstra,
Rafael J. Wysocki, Ralph Campbell, Thomas Gleixner, Tom Lendacky,
Vishal Verma, Wei Yang, Wei Yongjun, Will Deacon
> Neither the allocation nor the call to request_free_mem_region() has to
> be done under the lock so I moved those to the start of the function.
Can this information become relevant for another update step?
> Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM")
I find this commit reference interesting somehow.
How do you think about the commit 786ae133e07f2a6b352a0efad16b555ee45a2898
("lib: fix test_hmm.c reference after free" from 2020-06-26)
and the commit 1f9c4bb986d978a5e39153b39a71c9d098b65c5c ("mm/memremap_pages:
convert to 'struct range'" from 2020-09-23) for your update suggestion?
Regards,
Markus
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-09-25 19:30 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-22 8:12 [PATCH] mm/hmm/test: use after free in dmirror_allocate_chunk() Dan Carpenter
2020-09-22 17:31 ` Ralph Campbell
2020-09-24 13:46 ` [PATCH v2] " Dan Carpenter
2020-09-24 19:25 ` Ralph Campbell
2020-09-24 13:47 ` [PATCH] " Dan Carpenter
2020-09-25 19:30 [PATCH v2] " Markus Elfring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).