Commit 4a39afdd authored by Nicolin Chen's avatar Nicolin Chen Committed by Jason Zeng
Browse files

iommufd: Fix protection fault in iommufd_test_syz_conv_iova 

mainline inclusion
from mainline-v6.8-rc7
commit cf7c2789822db8b5efa34f5ebcf1621bc0008d48
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I938E2
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cf7c2789822db8b5efa34f5ebcf1621bc0008d48

--------------------------------

Syzkaller reported the following bug:

  general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN
  KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]
  Call Trace:
   lock_acquire
   lock_acquire+0x1ce/0x4f0
   down_read+0x93/0x4a0
   iommufd_test_syz_conv_iova+0x56/0x1f0
   iommufd_test_access_rw.isra.0+0x2ec/0x390
   iommufd_test+0x1058/0x1e30
   iommufd_fops_ioctl+0x381/0x510
   vfs_ioctl
   __do_sys_ioctl
   __se_sys_ioctl
   __x64_sys_ioctl+0x170/0x1e0
   do_syscall_x64
   do_syscall_64+0x71/0x140

This is because the new iommufd_access_change_ioas() sets access->ioas to
NULL during its process, so the lock might be gone in a concurrent racing
context.

Fix this by doing the same access->ioas sanity as iommufd_access_rw() and
iommufd_access_pin_pages() functions do.

Cc: stable@vger.kernel.org
Fixes: 9227da78 ("iommufd: Add iommufd_access_change_ioas(_id) helpers")
Link: https://lore.kernel.org/r/3f1932acaf1dd494d404c04364d73ce8f57f3e5e.1708636627.git.nicolinc@nvidia.com


Reported-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarNicolin Chen <nicolinc@nvidia.com>
Reviewed-by: default avatarKevin Tian <kevin.tian@intel.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarJason Zeng <jason.zeng@intel.com>
parent 00e953fa

drivers/iommu/iommufd/selftest.c

+21 −6
Original line number Diff line number Diff line
@@ -63,7 +63,7 @@ enum { 
 * In syzkaller mode the 64 bit IOVA is converted into an nth area and offset

 * value. This has a much smaller randomization space and syzkaller can hit it.

 */

static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt,

static unsigned long __iommufd_test_syz_conv_iova(struct io_pagetable *iopt,

						  u64 *iova)

{

	struct syz_layout {
@@ -88,6 +88,21 @@ static unsigned long iommufd_test_syz_conv_iova(struct io_pagetable *iopt, 
	return 0;

}



static unsigned long iommufd_test_syz_conv_iova(struct iommufd_access *access,

						u64 *iova)

{

	unsigned long ret;



	mutex_lock(&access->ioas_lock);

	if (!access->ioas) {

		mutex_unlock(&access->ioas_lock);

		return 0;

	}

	ret = __iommufd_test_syz_conv_iova(&access->ioas->iopt, iova);

	mutex_unlock(&access->ioas_lock);

	return ret;

}



void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd,

				   unsigned int ioas_id, u64 *iova, u32 *flags)

{
@@ -100,7 +115,7 @@ void iommufd_test_syz_conv_iova_id(struct iommufd_ucmd *ucmd, 
	ioas = iommufd_get_ioas(ucmd->ictx, ioas_id);

	if (IS_ERR(ioas))

		return;

	*iova = iommufd_test_syz_conv_iova(&ioas->iopt, iova);

	*iova = __iommufd_test_syz_conv_iova(&ioas->iopt, iova);

	iommufd_put_object(ucmd->ictx, &ioas->obj);

}
@@ -1161,7 +1176,7 @@ static int iommufd_test_access_pages(struct iommufd_ucmd *ucmd, 
	}



	if (flags & MOCK_FLAGS_ACCESS_SYZ)

		iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt,

		iova = iommufd_test_syz_conv_iova(staccess->access,

					&cmd->access_pages.iova);



	npages = (ALIGN(iova + length, PAGE_SIZE) -
@@ -1263,7 +1278,7 @@ static int iommufd_test_access_rw(struct iommufd_ucmd *ucmd, 
	}



	if (flags & MOCK_FLAGS_ACCESS_SYZ)

		iova = iommufd_test_syz_conv_iova(&staccess->access->ioas->iopt,

		iova = iommufd_test_syz_conv_iova(staccess->access,

				&cmd->access_rw.iova);



	rc = iommufd_access_rw(staccess->access, iova, tmp, length, flags);