> From: Laura Abbott [mailto:labbott@xxxxxxxxxx] > Sent: Saturday, February 20, 2016 5:09 AM > To: eun.taik.lee@xxxxxxxxxxx; gregkh@xxxxxxxxxxxxxxxxxxx; arve@xxxxxxxxxxx; > riandrews@xxxxxxxxxxx; sumit.semwal@xxxxxxxxxx; dan.carpenter@xxxxxxxxxx; > Rohit Kumar <rohit.kr@xxxxxxxxxxx>; sriram@xxxxxxxxxxxxx; shawn.lin@rock- > chips.com; devel@xxxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; > euntaik@xxxxxxxxx > Subject: Re: [PATCH v2] staging/android/ion : fix a race condition in the > ion driver > > On 02/19/2016 04:03 AM, EunTaik Lee wrote: > > There is a use-after-free problem in the ion driver. > > This is caused by a race condition in the ion_ioctl() function. > > > > A handle has ref count of 1 and two tasks on different cpus calls > > ION_IOC_FREE simultaneously. > > > > cpu 0 cpu 1 > > ------------------------------------------------------- > > ion_handle_get_by_id() > > (ref == 2) > > ion_handle_get_by_id() > > (ref == 3) > > > > ion_free() > > (ref == 2) > > > > ion_handle_put() > > (ref == 1) > > > > ion_free() > > (ref == 0 so ion_handle_destroy() is > > called > > and the handle is freed.) > > > > ion_handle_put() is called and it > > decreases the slub's next free pointer > > > > The problem is detected as an unaligned access in the spin lock > > functions since it uses load exclusive > > instruction. In some cases it corrupts the slub's free pointer which > > causes a mis-aligned access to the next free pointer.(kmalloc returns > > a pointer like ffffc0745b4580aa). And it causes lots of other > > hard-to-debug problems. > > > > This symptom is caused since the first member in the ion_handle > > structure is the reference count and the ion driver decrements the > > reference after it has been freed. > > > > To fix this problem client->lock mutex is extended to protect all the > > codes that uses the handle. > > > > Signed-off-by: Eun Taik Lee <eun.taik.lee@xxxxxxxxxxx> > > --- > > changes in v2 : > > 1. add problem description in the comment > > 2. fix un-matching mutex_lock/unlock pair in ion_share_dma_buf() > > > > drivers/staging/android/ion/ion.c | 102 > ++++++++++++++++++++++++++++++-------- > > 1 file changed, 82 insertions(+), 20 deletions(-) > > > > diff --git a/drivers/staging/android/ion/ion.c > > b/drivers/staging/android/ion/ion.c > > index e237e9f..c6fbe48 100644 > > --- a/drivers/staging/android/ion/ion.c > > +++ b/drivers/staging/android/ion/ion.c > > @@ -385,13 +385,22 @@ static void ion_handle_get(struct ion_handle > *handle) > > kref_get(&handle->ref); > > } > > > > +static int ion_handle_put_nolock(struct ion_handle *handle) { > > + int ret; > > + > > + ret = kref_put(&handle->ref, ion_handle_destroy); > > + > > + return ret; > > +} > > + > > the > > > static int ion_handle_put(struct ion_handle *handle) > > { > > struct ion_client *client = handle->client; > > int ret; > > > > mutex_lock(&client->lock); > > - ret = kref_put(&handle->ref, ion_handle_destroy); > > + ret = ion_handle_put_nolock(handle); > > mutex_unlock(&client->lock); > > > > return ret; > > @@ -415,20 +424,30 @@ static struct ion_handle *ion_handle_lookup(struct > ion_client *client, > > return ERR_PTR(-EINVAL); > > } > > > > -static struct ion_handle *ion_handle_get_by_id(struct ion_client > *client, > > - int id) > > +static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client > *client, > > + int id) > > { > > struct ion_handle *handle; > > > > - mutex_lock(&client->lock); > > handle = idr_find(&client->idr, id); > > if (handle) > > ion_handle_get(handle); > > - mutex_unlock(&client->lock); > > > > return handle ? handle : ERR_PTR(-EINVAL); > > } > > > > +struct ion_handle *ion_handle_get_by_id(struct ion_client *client, > > + int id) > > +{ > > + struct ion_handle *handle; > > + > > + mutex_lock(&client->lock); > > + handle = ion_handle_get_by_id_nolock(client, id); > > + mutex_unlock(&client->lock); > > + > > + return handle; > > +} > > + > > static bool ion_handle_validate(struct ion_client *client, > > struct ion_handle *handle) > > { > > @@ -530,7 +549,8 @@ struct ion_handle *ion_alloc(struct ion_client > *client, size_t len, > > } > > EXPORT_SYMBOL(ion_alloc); > > > > -void ion_free(struct ion_client *client, struct ion_handle *handle) > > +static void ion_free_nolock(struct ion_client *client, > > + struct ion_handle *handle) > > { > > bool valid_handle; > > > > @@ -538,15 +558,24 @@ void ion_free(struct ion_client *client, struct > > ion_handle *handle) > > > > mutex_lock(&client->lock); > > valid_handle = ion_handle_validate(client, handle); > > - > > if (!valid_handle) { > > WARN(1, "%s: invalid handle passed to free.\n", __func__); > > mutex_unlock(&client->lock); > > return; > > } > > + ion_handle_put_nolock(handle); > > +} > > + > > +void ion_free(struct ion_client *client, struct ion_handle *handle) { > > + BUG_ON(client != handle->client); > > + > > + mutex_lock(&client->lock); > > + ion_free_nolock(client, handle); > > mutex_unlock(&client->lock); > > ion_handle_put(handle); > > } > > + > > EXPORT_SYMBOL(ion_free); > > > > This still doesn't look right. ion_handle_put is being called twice on > ion_free, once in ion_free_nolock and once again right after. Please > double check this > Yes, that shouldn't have been there. > > int ion_phys(struct ion_client *client, struct ion_handle *handle, > > @@ -830,6 +859,7 @@ void ion_client_destroy(struct ion_client *client) > > struct rb_node *n; > > > > pr_debug("%s: %d\n", __func__, __LINE__); > > + mutex_lock(&client->lock); > > while ((n = rb_first(&client->handles))) { > > struct ion_handle *handle = rb_entry(n, struct ion_handle, > > node); > > @@ -837,6 +867,7 @@ void ion_client_destroy(struct ion_client *client) > > } > > > > idr_destroy(&client->idr); > > + mutex_unlock(&client->lock); > > > > The mutex_lock here isn't necessary. This is the client destroy and > handles are local to a client so there is nothing to protect here. If > ion_client_destroy is being called on the same client at the same time we > have bigger issues. > > > > down_write(&dev->lock); > > if (client->task) > > @@ -1100,7 +1131,7 @@ static struct dma_buf_ops dma_buf_ops = { > > .kunmap = ion_dma_buf_kunmap, > > }; > > > > -struct dma_buf *ion_share_dma_buf(struct ion_client *client, > > +static struct dma_buf *ion_share_dma_buf_nolock(struct ion_client > > +*client, > > struct ion_handle *handle) > > { > > DEFINE_DMA_BUF_EXPORT_INFO(exp_info); > > @@ -1108,7 +1139,6 @@ struct dma_buf *ion_share_dma_buf(struct > ion_client *client, > > struct dma_buf *dmabuf; > > bool valid_handle; > > > > - mutex_lock(&client->lock); > > valid_handle = ion_handle_validate(client, handle); > > if (!valid_handle) { > > WARN(1, "%s: invalid handle passed to share.\n", __func__); > @@ > > -1117,7 +1147,6 @@ struct dma_buf *ion_share_dma_buf(struct ion_client > *client, > > } > > buffer = handle->buffer; > > ion_buffer_get(buffer); > > - mutex_unlock(&client->lock); > > > > exp_info.ops = &dma_buf_ops; > > exp_info.size = buffer->size; > > @@ -1132,14 +1161,26 @@ struct dma_buf *ion_share_dma_buf(struct > > ion_client *client, > > > > return dmabuf; > > } > > + > > +struct dma_buf *ion_share_dma_buf(struct ion_client *client, > > + struct ion_handle *handle) > > +{ > > + struct dma_buf *dmabuf; > > + > > + mutex_lock(&client->lock); > > + dmabuf = ion_share_dma_buf_nolock(client, handle); > > + mutex_unlock(&client->lock); > > + return dmabuf; > > +} > > EXPORT_SYMBOL(ion_share_dma_buf); > > > > -int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle > > *handle) > > +static int ion_share_dma_buf_fd_nolock(struct ion_client *client, > > + struct ion_handle *handle) > > { > > struct dma_buf *dmabuf; > > int fd; > > > > - dmabuf = ion_share_dma_buf(client, handle); > > + dmabuf = ion_share_dma_buf_nolock(client, handle); > > if (IS_ERR(dmabuf)) > > return PTR_ERR(dmabuf); > > > > @@ -1149,6 +1190,17 @@ int ion_share_dma_buf_fd(struct ion_client > > *client, struct ion_handle *handle) > > > > return fd; > > } > > + > > +int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle > > +*handle) { > > + int fd; > > + > > + mutex_lock(&client->lock); > > + fd = ion_share_dma_buf_fd_nolock(client, handle); > > + mutex_unlock(&client->lock); > > + > > + return fd; > > +} > > EXPORT_SYMBOL(ion_share_dma_buf_fd); > > > > struct ion_handle *ion_import_dma_buf(struct ion_client *client, int > > fd) @@ -1281,11 +1333,16 @@ static long ion_ioctl(struct file *filp, > unsigned int cmd, unsigned long arg) > > { > > struct ion_handle *handle; > > > > - handle = ion_handle_get_by_id(client, data.handle.handle); > > - if (IS_ERR(handle)) > > + mutex_lock(&client->lock); > > + handle = ion_handle_get_by_id_nolock(client, > > + data.handle.handle); > > + if (IS_ERR(handle)) { > > + mutex_unlock(&client->lock); > > return PTR_ERR(handle); > > - ion_free(client, handle); > > - ion_handle_put(handle); > > + } > > + ion_free_nolock(client, handle); > > + ion_handle_put_nolock(handle); > > + mutex_unlock(&client->lock); > > break; > > } > > case ION_IOC_SHARE: > > @@ -1293,11 +1350,16 @@ static long ion_ioctl(struct file *filp, > unsigned int cmd, unsigned long arg) > > { > > struct ion_handle *handle; > > > > - handle = ion_handle_get_by_id(client, data.handle.handle); > > - if (IS_ERR(handle)) > > + mutex_lock(&client->lock); > > + handle = ion_handle_get_by_id_nolock(client, > > + data.handle.handle); > > + if (IS_ERR(handle)) { > > + mutex_unlock(&client->lock); > > return PTR_ERR(handle); > > - data.fd.fd = ion_share_dma_buf_fd(client, handle); > > - ion_handle_put(handle); > > + } > > + data.fd.fd = ion_share_dma_buf_fd_nolock(client, handle); > > + ion_handle_put_nolock(handle); > > + mutex_unlock(&client->lock); > > if (data.fd.fd < 0) > > ret = data.fd.fd; > > break; > > > > I don't think this is necessary. We had the race in ION_IOC_FREE because > the free operation didn't happen atomically. It was possible to have two > different threads destroying the handle at the same time. With > ION_IOC_MAP/ION_IOC_SHARE, ion_handle_get_by_id will get a reference so > assuming there are no other races, that should ensure the handle will not > be destroyed. > > Is there another race you can see in the code that I missed? > I was thinking about ion_client_destroy being called when ION_IOC_MAP/ION_IOC_SHARE is executing. But I don't think that is possible. So I agree that we don't need to protect ION_IOC_MAP/ION_IOC_SHARE and ion_client_destroy with the mutex. Thanks, Euntaik _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
