lkml.org 
[lkml]   [2022]   [Sep]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH 3/3] misc: fastrpc: Fix use-after-free race condition for maps
From


On 02/09/2022 16:14, Abel Vesa wrote:
> From: Ola Jeppsson <ola@snap.com>
>
> It is possible that in between calling fastrpc_map_get() until
> map->fl->lock is taken in fastrpc_free_map(), another thread can call
> fastrpc_map_lookup() and get a reference to a map that is about to be
> deleted.
>
yes, there is a margin of window here.
Also am surprised to see the race for same map fd.

fastrpc_map_get() is always under a lock, have you tried adding locking
for fastrpc_map_put().


> Rewrite fastrpc_map_get() to only increase the reference count of a map
> if it's non-zero. Propagate this to callers so they can know if a map is
> about to be deleted.
This will work but it would be better to fix the window of race.

--srini

>
> Fixes this warning:
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate
> ...
> Call trace:
> refcount_warn_saturate
> [fastrpc_map_get inlined]
> [fastrpc_map_lookup inlined]
> fastrpc_map_create
> fastrpc_internal_invoke
> fastrpc_device_ioctl
> __arm64_sys_ioctl
> invoke_syscall
>
> Fixes: c68cfb718c8f9 ("misc: fastrpc: Add support for context Invoke method")
> Signed-off-by: Ola Jeppsson <ola@snap.com>
> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
> ---
> drivers/misc/fastrpc.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
> index 50c17f5da3a8..58654d394d17 100644
> --- a/drivers/misc/fastrpc.c
> +++ b/drivers/misc/fastrpc.c
> @@ -332,10 +332,12 @@ static void fastrpc_map_put(struct fastrpc_map *map)
> kref_put(&map->refcount, fastrpc_free_map);
> }
>
> -static void fastrpc_map_get(struct fastrpc_map *map)
> +static int fastrpc_map_get(struct fastrpc_map *map)
> {
> - if (map)
> - kref_get(&map->refcount);
> + if (!map)
> + return -ENOENT;
> +
> + return kref_get_unless_zero(&map->refcount) ? 0 : -ENOENT;
> }
>
>

\
 
 \ /
  Last update: 2022-09-23 00:46    [W:0.063 / U:0.536 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site