lkml.org 
[lkml]   [2021]   [Sep]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 043/380] VMCI: fix NULL pointer dereference when unmapping queue pair
    Date
    From: Wang Hai <wanghai38@huawei.com>

    commit a30dc6cf0dc51419021550152e435736aaef8799 upstream.

    I got a NULL pointer dereference report when doing fuzz test:

    Call Trace:
    qp_release_pages+0xae/0x130
    qp_host_unregister_user_memory.isra.25+0x2d/0x80
    vmci_qp_broker_unmap+0x191/0x320
    ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0
    vmci_host_unlocked_ioctl+0x59f/0xd50
    ? do_vfs_ioctl+0x14b/0xa10
    ? tomoyo_file_ioctl+0x28/0x30
    ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0
    __x64_sys_ioctl+0xea/0x120
    do_syscall_64+0x34/0xb0
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    When a queue pair is created by the following call, it will not
    register the user memory if the page_store is NULL, and the
    entry->state will be set to VMCIQPB_CREATED_NO_MEM.

    vmci_host_unlocked_ioctl
    vmci_host_do_alloc_queuepair
    vmci_qp_broker_alloc
    qp_broker_alloc
    qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM;

    When unmapping this queue pair, qp_host_unregister_user_memory() will
    be called to unregister the non-existent user memory, which will
    result in a null pointer reference. It will also change
    VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be
    present in this operation.

    Only when the qp broker has mem, it can unregister the user
    memory when unmapping the qp broker.

    Only when the qp broker has no mem, it can register the user
    memory when mapping the qp broker.

    Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
    Cc: stable <stable@vger.kernel.org>
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Link: https://lore.kernel.org/r/20210818124845.488312-1-wanghai38@huawei.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
    +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    @@ -2243,7 +2243,8 @@ int vmci_qp_broker_map(struct vmci_handl

    result = VMCI_SUCCESS;

    - if (context_id != VMCI_HOST_CONTEXT_ID) {
    + if (context_id != VMCI_HOST_CONTEXT_ID &&
    + !QPBROKERSTATE_HAS_MEM(entry)) {
    struct vmci_qp_page_store page_store;

    page_store.pages = guest_mem;
    @@ -2350,7 +2351,8 @@ int vmci_qp_broker_unmap(struct vmci_han
    goto out;
    }

    - if (context_id != VMCI_HOST_CONTEXT_ID) {
    + if (context_id != VMCI_HOST_CONTEXT_ID &&
    + QPBROKERSTATE_HAS_MEM(entry)) {
    qp_acquire_queue_mutex(entry->produce_q);
    result = qp_save_headers(entry);
    if (result < VMCI_SUCCESS)

    \
     
     \ /
      Last update: 2021-09-16 19:07    [W:2.106 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site