lkml.org 
[lkml]   [2023]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [v6 PATCH 4/5] iommu: Support mm PASID 1:n with sva domains
    From


    On 10/11/23 20:39, Jason Gunthorpe wrote:
    > On Wed, Oct 11, 2023 at 02:51:31PM +0800, Tina Zhang wrote:
    >
    >> diff --git a/kernel/fork.c b/kernel/fork.c
    >> index 3b6d20dfb9a8..985403a7a747 100644
    >> --- a/kernel/fork.c
    >> +++ b/kernel/fork.c
    >> @@ -1277,7 +1277,6 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p,
    >> mm_init_cpumask(mm);
    >> mm_init_aio(mm);
    >> mm_init_owner(mm, p);
    >> - mm_pasid_init(mm);
    >> RCU_INIT_POINTER(mm->exe_file, NULL);
    >> mmu_notifier_subscriptions_init(mm);
    >> init_tlb_flush_pending(mm);
    >
    > Nicolin debugged his crash report last night and sent me the details.
    >
    > This hunk is the cause of the bug that Nicolin reported.
    >
    > The dup_mm() flow does:
    >
    > static struct mm_struct *dup_mm(struct task_struct *tsk,
    > struct mm_struct *oldmm)
    > {
    > struct mm_struct *mm;
    > int err;
    >
    > mm = allocate_mm();
    > if (!mm)
    > goto fail_nomem;
    >
    > memcpy(mm, oldmm, sizeof(*mm));
    >
    > if (!mm_init(mm, tsk, mm->user_ns))
    > goto fail_nomem;
    >
    > It is essential that mm_pasid_init() zero the new pointer otherwise,
    > due to the memcpy, after a fork two mm structs will point to the same
    > thing and one will UAF/doube free.
    Good catch.

    Thanks,
    -Tina
    >
    > Keep mm_pasid_init() and add zeroing the new pointer to it.
    >
    > Jason

    \
     
     \ /
      Last update: 2023-10-11 15:27    [W:3.109 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site