From patchwork Wed Apr 17 09:38:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Beata Michalska X-Patchwork-Id: 13633113 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4D496C4345F for ; Wed, 17 Apr 2024 09:39:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=w0Ublsh64zBgybwvDVlOZPL9YOLEhnkTEQ3MZksCxpo=; b=OtHpc20aHxnymz 2Vei0x4nKVkbzks9h3SXrlbOevkJdh5AtWZmtpEWsJItHIHa98f6TW4rXpKlLA9f08txbThptAW0G AnRudX49BSHWcG4m2FVPdC1LmX5x4HYr6w58GdrXV7kn5sf0FABD7mm1kTd5a6i+HX9pfBOI8Xh77 AO6yoIMIHI9ySBKMVjsyijiGCxboSD4jy5XOsITfi6YWY/qUw85eX9YKRNW/qZCWi+U1A6VwkRHVB s+vra1SjKIe5VLQlrni+GFY6kwiKicAjv7Tl9RaCKRsuGuHok4zVoeTm/iHj95ASilbffGhMX1WK9 eAJROvjDZeUNDkBO2oWg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rx1l4-0000000FRkg-0Mh8; Wed, 17 Apr 2024 09:39:14 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rx1ku-0000000FRh6-3wmU for linux-arm-kernel@lists.infradead.org; Wed, 17 Apr 2024 09:39:06 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 3870B1477; Wed, 17 Apr 2024 02:39:32 -0700 (PDT) Received: from e125905.cambridge.arm.com (e125905.cambridge.arm.com [10.1.194.73]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 808E13F64C; Wed, 17 Apr 2024 02:39:02 -0700 (PDT) From: Beata Michalska To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, ionela.voinescu@arm.com, vanshikonda@os.amperecomputing.com Cc: sudeep.holla@arm.com, will@kernel.org, catalin.marinas@arm.com, vincent.guittot@linaro.org, sumitg@nvidia.com, yang@os.amperecomputing.com, lihuisong@huawei.com, viresh.kumar@linaro.org Subject: [PATCH v5 2/5] arm64: amu: Rule out potential use after free Date: Wed, 17 Apr 2024 10:38:45 +0100 Message-Id: <20240417093848.1555462-3-beata.michalska@arm.com> In-Reply-To: <20240417093848.1555462-1-beata.michalska@arm.com> References: <20240417093848.1555462-1-beata.michalska@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240417_023905_105600_A1243D91 X-CRM114-Status: GOOD ( 10.00 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org For the time being, the amu_fie_cpus cpumask is being exclusively used by the AMU-related internals of FIE support and is guaranteed to be valid on every access currently made. Still the mask is not being invalidated on one of the error handling code paths, which leaves a soft spot with potential risk of uaf for CPUMASK_OFFSTACK cases. To make things sound, set the cpumaks pointer explicitly to NULL upon failing to register the cpufreq notifier. Note that, due to the quirks of CPUMASK_OFFSTACK, this change needs to be wrapped with grim ifdefing (it would be better served by incorporating this into free_cpumask_var ...) Signed-off-by: Beata Michalska --- arch/arm64/kernel/topology.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/topology.c b/arch/arm64/kernel/topology.c index 1a2c72f3e7f8..3c814a278534 100644 --- a/arch/arm64/kernel/topology.c +++ b/arch/arm64/kernel/topology.c @@ -244,8 +244,12 @@ static int __init init_amu_fie(void) ret = cpufreq_register_notifier(&init_amu_fie_notifier, CPUFREQ_POLICY_NOTIFIER); - if (ret) + if (ret) { free_cpumask_var(amu_fie_cpus); +#ifdef CONFIG_CPUMASK_OFFSTACK + amu_fie_cpus = NULL; +#endif + } return ret; }