Patch "vfio/pds: Make sure migration file isn't accessed after reset" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    vfio/pds: Make sure migration file isn't accessed after reset

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vfio-pds-make-sure-migration-file-isn-t-accessed-aft.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8da00a760f7e25ef222ec07dc9030bb0fe7555b6
Author: Brett Creeley <brett.creeley@xxxxxxx>
Date:   Fri Mar 8 10:21:48 2024 -0800

    vfio/pds: Make sure migration file isn't accessed after reset
    
    [ Upstream commit 457f7308254756b6e4b8fc3876cb770dcf0e7cc7 ]
    
    It's possible the migration file is accessed after reset when it has
    been cleaned up, especially when it's initiated by the device. This is
    because the driver doesn't rip out the filep when cleaning up it only
    frees the related page structures and sets its local struct
    pds_vfio_lm_file pointer to NULL. This can cause a NULL pointer
    dereference, which is shown in the example below during a restore after
    a device initiated reset:
    
    BUG: kernel NULL pointer dereference, address: 000000000000000c
    PF: supervisor read access in kernel mode
    PF: error_code(0x0000) - not-present page
    PGD 0 P4D 0
    Oops: 0000 [#1] PREEMPT SMP NOPTI
    RIP: 0010:pds_vfio_get_file_page+0x5d/0xf0 [pds_vfio_pci]
    [...]
    Call Trace:
     <TASK>
     pds_vfio_restore_write+0xf6/0x160 [pds_vfio_pci]
     vfs_write+0xc9/0x3f0
     ? __fget_light+0xc9/0x110
     ksys_write+0xb5/0xf0
     __x64_sys_write+0x1a/0x20
     do_syscall_64+0x38/0x90
     entry_SYSCALL_64_after_hwframe+0x63/0xcd
    [...]
    
    Add a disabled flag to the driver's struct pds_vfio_lm_file that gets
    set during cleanup. Then make sure to check the flag when the migration
    file is accessed via its file_operations. By default this flag will be
    false as the memory for struct pds_vfio_lm_file is kzalloc'd, which means
    the struct pds_vfio_lm_file is enabled and accessible. Also, since the
    file_operations and driver's migration file cleanup happen under the
    protection of the same pds_vfio_lm_file.lock, using this flag is thread
    safe.
    
    Fixes: 8512ed256334 ("vfio/pds: Always clear the save/restore FDs on reset")
    Reviewed-by: Shannon Nelson <shannon.nelson@xxxxxxx>
    Signed-off-by: Brett Creeley <brett.creeley@xxxxxxx>
    Link: https://lore.kernel.org/r/20240308182149.22036-2-brett.creeley@xxxxxxx
    Signed-off-by: Alex Williamson <alex.williamson@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/vfio/pci/pds/lm.c b/drivers/vfio/pci/pds/lm.c
index 79fe2e66bb498..6b94cc0bf45b4 100644
--- a/drivers/vfio/pci/pds/lm.c
+++ b/drivers/vfio/pci/pds/lm.c
@@ -92,8 +92,10 @@ static void pds_vfio_put_lm_file(struct pds_vfio_lm_file *lm_file)
 {
 	mutex_lock(&lm_file->lock);
 
+	lm_file->disabled = true;
 	lm_file->size = 0;
 	lm_file->alloc_size = 0;
+	lm_file->filep->f_pos = 0;
 
 	/* Free scatter list of file pages */
 	sg_free_table(&lm_file->sg_table);
@@ -183,6 +185,12 @@ static ssize_t pds_vfio_save_read(struct file *filp, char __user *buf,
 	pos = &filp->f_pos;
 
 	mutex_lock(&lm_file->lock);
+
+	if (lm_file->disabled) {
+		done = -ENODEV;
+		goto out_unlock;
+	}
+
 	if (*pos > lm_file->size) {
 		done = -EINVAL;
 		goto out_unlock;
@@ -283,6 +291,11 @@ static ssize_t pds_vfio_restore_write(struct file *filp, const char __user *buf,
 
 	mutex_lock(&lm_file->lock);
 
+	if (lm_file->disabled) {
+		done = -ENODEV;
+		goto out_unlock;
+	}
+
 	while (len) {
 		size_t page_offset;
 		struct page *page;
diff --git a/drivers/vfio/pci/pds/lm.h b/drivers/vfio/pci/pds/lm.h
index 13be893198b74..9511b1afc6a11 100644
--- a/drivers/vfio/pci/pds/lm.h
+++ b/drivers/vfio/pci/pds/lm.h
@@ -27,6 +27,7 @@ struct pds_vfio_lm_file {
 	struct scatterlist *last_offset_sg;	/* Iterator */
 	unsigned int sg_last_entry;
 	unsigned long last_offset;
+	bool disabled;
 };
 
 struct pds_vfio_pci_device;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux