lkml.org 
[lkml]   [2021]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH 1/2] vhost-vdpa: fix use-after-free of v->config_ctx
From
Date


On 3/11/2021 9:52 PM, Stefano Garzarella wrote:
> When the 'v->config_ctx' eventfd_ctx reference is released we didn't
> set it to NULL. So if the same character device (e.g. /dev/vhost-vdpa-0)
> is re-opened, the 'v->config_ctx' is invalid and calling again
> vhost_vdpa_config_put() causes use-after-free issues like the
> following refcount_t underflow:
>
> refcount_t: underflow; use-after-free.
> WARNING: CPU: 2 PID: 872 at lib/refcount.c:28 refcount_warn_saturate+0xae/0xf0
> RIP: 0010:refcount_warn_saturate+0xae/0xf0
> Call Trace:
> eventfd_ctx_put+0x5b/0x70
> vhost_vdpa_release+0xcd/0x150 [vhost_vdpa]
> __fput+0x8e/0x240
> ____fput+0xe/0x10
> task_work_run+0x66/0xa0
> exit_to_user_mode_prepare+0x118/0x120
> syscall_exit_to_user_mode+0x21/0x50
> ? __x64_sys_close+0x12/0x40
> do_syscall_64+0x45/0x50
> entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> Fixes: 776f395004d8 ("vhost_vdpa: Support config interrupt in vdpa")
> Cc: lingshan.zhu@intel.com
> Cc: stable@vger.kernel.org
> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
> ---
> drivers/vhost/vdpa.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ef688c8c0e0e..00796e4ecfdf 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -308,8 +308,10 @@ static long vhost_vdpa_get_vring_num(struct vhost_vdpa *v, u16 __user *argp)
>
> static void vhost_vdpa_config_put(struct vhost_vdpa *v)
> {
> - if (v->config_ctx)
> + if (v->config_ctx) {
> eventfd_ctx_put(v->config_ctx);
> + v->config_ctx = NULL;
> + }
> }
>
> static long vhost_vdpa_set_config_call(struct vhost_vdpa *v, u32 __user *argp)
Thanks Stefano!

Reviewed-by: Zhu Lingshan <lingshan.zhu@intel.com>

\
 
 \ /
  Last update: 2021-03-12 02:38    [W:1.475 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site