From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f53.google.com (mail-wr1-f53.google.com [209.85.221.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15BE313BC0C for ; Mon, 23 Dec 2024 16:03:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734969790; cv=none; b=jg7AzzFwRfWn8lHtU/Nzr9dc8kWXltcQQC+lS26YkJuzTjv1Vzh7fK+TxhBKhlnZGNGlTWmxwA5cN4lhmcT4BbV3oPGLglk6vIS98LYkxODzieie2/vQPRCZc0kgqlEvC/EjoKJa6bBC4QCazTrasV9/ICwKLKGCYcXHTFEUzzo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734969790; c=relaxed/simple; bh=9WLSEsQ95GMdutztqtza4grRQLIx+zmZtAObaWCmmvY=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=KQMUiG1GjL5BlyhccfVu2Soe+xSZI61WTZfAX3Yj0tWERw6M43zfUolWGNsFM/Rswy8ZkudOawtKVCEpZkShMZSP80NRPgo8xp/PrVV4P/lwbFHx6C9jChwyczbf7k8xZf45zIrFyhSw6ejlU3U1ct5JgMVDoz50hu26j6B52PQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=eE1yHNSB; arc=none smtp.client-ip=209.85.221.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="eE1yHNSB" Received: by mail-wr1-f53.google.com with SMTP id ffacd0b85a97d-385de59c1a0so2580668f8f.2 for ; Mon, 23 Dec 2024 08:03:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1734969786; x=1735574586; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=LdWzaenhPj7pSVDMbmZ1N+E1ysWgJk1/ElEfwgye+7I=; b=eE1yHNSBf2fozOhuSZkYsB6oCHjvRqLHOZliDoM0Cjaf+KOuLJJR7PQSWRVrnBm11h 5g+rwqiGJqF0DLHiYRkKhq/3libZFEHBPxCYtpKBmlA57ZcP6KBy7r4OjVW0uqxkiGQX EGbBDyZunPSOuQB1yLIB61bb7tIF96t430iGYMqthq8nKHIJTs/Dhl5KbcLcmtFcuaGu aStRzcAN6+0q/Gd7Jtmr4qkF3rQ1wRIPwGdSg4okYzWltpFcR4H8iKzgpBV3Mxsgpl0M 7WsWVCXxP16/PzpQ9lXOtNjH9Q0bEM25vPe1TkDfRNGDffx4tH0kFbW5rdJDO9T/zek7 WfXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1734969786; x=1735574586; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=LdWzaenhPj7pSVDMbmZ1N+E1ysWgJk1/ElEfwgye+7I=; b=IzGhSOkxFx60Xmr/m6peuqRFOq851ZtL/qRd9h3sVNJ8+UvMAFn8wGL3Snd4q95qLj aj/+n3K9yb9lGfMxfhOWAnHvP5S9suJl8hi1zXP9L2KDY2kz6otMGzsvZygT1bxT6i5x ekWE6NW1J7ivFhxzoFaLGmCCxhoFphvRwcvTOR3NNRvX8WiU0TVh12scAfDOCFQgen0k ToB5mIt0CUtKNScJoE0GSp4LkhBXjExphrszlOizUkt53WpLJARQ2kaIi4SzDGQ79hjl DA1VOvabxZRfXofuxd1N08BhGfX9LOU95moJD85xlwESCpuVj+sJBUElCi0R3iHlhnXD pHyg== X-Forwarded-Encrypted: i=1; AJvYcCVD4HkXWRXi3nTO0OfMjvYiGTCa1EW92Ck8HQqJ5uQuSc4L116et1dL2oPtCjerBYQeqXVA/pyKlF3y1ek=@vger.kernel.org X-Gm-Message-State: AOJu0YwsdlFP7/u5aLvkOWICTnqqp4H1kFPIxPxJ2WpWudEpYOZTMNJ/ fHbCbaIYT6pL8tm1iRmUtLPidt6uUlKezHF2vgi9AIBagFsXzgmZABsChc0JjHM= X-Gm-Gg: ASbGncuVsaO8E7lh3mjncQrawqVzhpN1aewG/q5L61HVQOBVKzEZv6dDuyX/simUonO 40LTScXT84+Jh36DO1PDBWJd9xsnHedL2cYX0a2dS8MqE6SuhNeMAlXMs0gcyH45rMSrEqX7g7g JF0BU14YcHPdHfFJVvUkYQ/qxgWjfPusXy9PLD6UU6QLCQaddkYGnohgRx5acaFB+JEuadm849N jomyuQbQH1UAPv1hk8a7Ga7iHpiNffIjg9nz7ySl56WfpOu4Q0xk69bZNH0Ya0hfA== X-Google-Smtp-Source: AGHT+IHE60Dcf13LiIZMUWHdjLhfBh3lAm+HyejnZ05aJSHnLJRvay2L62GWlLu036olqZopHY+Y3Q== X-Received: by 2002:a05:6000:4007:b0:385:d852:29ed with SMTP id ffacd0b85a97d-38a223f5ca6mr11396539f8f.36.1734969786195; Mon, 23 Dec 2024 08:03:06 -0800 (PST) Received: from [192.168.68.163] ([145.224.66.70]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-43656b3b1f6sm176212645e9.31.2024.12.23.08.03.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 23 Dec 2024 08:03:05 -0800 (PST) Message-ID: <0efe4ef1-30f5-47f8-b818-79b4cfa0891f@linaro.org> Date: Mon, 23 Dec 2024 16:03:04 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] coresight: prevent deactivate active config while enable the config To: Yeoreum Yun , Mike Leach Cc: coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, nd@arm.com, suzuki.poulose@arm.com, mike.leach@linaro.org, alexander.shishkin@linux.intel.com References: <20241218084833.609876-1-yeoreum.yun@arm.com> Content-Language: en-US From: James Clark In-Reply-To: <20241218084833.609876-1-yeoreum.yun@arm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 18/12/2024 8:48 am, Yeoreum Yun wrote: > While enable active config via cscfg_csdev_enable_active_config(), > active config could be deactivated via configfs' sysfs interface. > This could make UAF issue in below scenario: > > CPU0 CPU1 > (perf or sysfs enable) load module > cscfg_load_config_sets() > activate config. // sysfs > (sys_active_cnt == 1) > ... > cscfg_csdev_enable_active_config() > lock(csdev->cscfg_csdev_lock) > // here load config activate by CPU1 > unlock(csdev->cscfg_csdev_lock) > > deactivate config // sysfs > (sys_activec_cnt == 0) Assuming the left side does Perf, are there some steps missing? To get to enable_active_config() you first need to pass through etm_setup_aux() -> cscfg_activate_config(). That would also increment sys_active_cnt which would leave it at 2 if there were two concurrent sessions. Then it would end up as 1 here after deactivate, rather than 0. It's not explicitly mentioned in the sequence but I'm assuming the left and right are the same config, but I suppose it could be an issue with different configs too. > cscfg_unload_config_sets() > unload module On the left cscfg_activate_config() also bumps the module refcount, so unload wouldn't cause a UAF here as far as I can see. > > // access to config_desc which freed > // while unloading module. > cfs_csdev_enable_config > > To address this, introduce sys_enable_cnt in cscfg_mgr to prevent > deactivate while there is enabled configuration. > > Signed-off-by: Yeoreum Yun > --- > .../hwtracing/coresight/coresight-etm4x-core.c | 3 +++ > drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++-- > drivers/hwtracing/coresight/coresight-syscfg.h | 2 ++ > 3 files changed, 21 insertions(+), 2 deletions(-) > > diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c > index 86893115df17..6218ef40acbc 100644 > --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c > +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c > @@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev) > smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1); > > raw_spin_unlock(&drvdata->spinlock); > + > + cscfg_csdev_disable_active_config(csdev); > + > cpus_read_unlock(); > > /* > diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c > index a70c1454b410..dfa7dcbaf25d 100644 > --- a/drivers/hwtracing/coresight/coresight-syscfg.c > +++ b/drivers/hwtracing/coresight/coresight-syscfg.c > @@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti > cscfg_mgr->sysfs_active_config = cfg_hash; > } else { > /* disable if matching current value */ > - if (cscfg_mgr->sysfs_active_config == cfg_hash) { > + if (cscfg_mgr->sysfs_active_config == cfg_hash && > + !atomic_read(&cscfg_mgr->sys_enable_cnt)) { > _cscfg_deactivate_config(cfg_hash); So is sys_enable_cnt a global value? If a fix is needed doesn't it need to be a per-config refcount? Say you have two active configs, sys_enable_cnt is now 2, how do you disable one without it always skipping here when the other config is enabled? > cscfg_mgr->sysfs_active_config = 0; > } else > @@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, > if (!atomic_read(&cscfg_mgr->sys_active_cnt)) > return 0; > > + /* > + * increment sys_enable_cnt first to prevent deactivate the config > + * while enable active config. > + */ > + atomic_inc(&cscfg_mgr->sys_enable_cnt); > + > /* > * Look for matching configuration - set the active configuration > * context if found. > @@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, > raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); > } > } > + > + if (!config_csdev_active || err) > + atomic_dec(&cscfg_mgr->sys_enable_cnt); > + > return err; > } > EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config); > @@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev) > if (config_csdev) { > if (!config_csdev->enabled) > config_csdev = NULL; > - else > + else { > config_csdev->enabled = false; > + atomic_dec(&cscfg_mgr->sys_enable_cnt); > + } > } > csdev->active_cscfg_ctxt = NULL; > raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); > @@ -1179,6 +1192,7 @@ static int cscfg_create_device(void) > INIT_LIST_HEAD(&cscfg_mgr->config_desc_list); > INIT_LIST_HEAD(&cscfg_mgr->load_order_list); > atomic_set(&cscfg_mgr->sys_active_cnt, 0); > + atomic_set(&cscfg_mgr->sys_enable_cnt, 0); > cscfg_mgr->load_state = CSCFG_NONE; > > /* setup the device */ > diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h > index 66e2db890d82..2fc397919985 100644 > --- a/drivers/hwtracing/coresight/coresight-syscfg.h > +++ b/drivers/hwtracing/coresight/coresight-syscfg.h > @@ -38,6 +38,7 @@ enum cscfg_load_ops { > * @config_desc_list: List of system configuration descriptors to load into registered devices. > * @load_order_list: Ordered list of owners for dynamically loaded configurations. > * @sys_active_cnt: Total number of active config descriptor references. > + * @sys_enable_cnt: Total number of enable of active config descriptor references. When these are next to each other it makes me wonder why active_cnt isn't enough to prevent unloading? Enabled is always a subset of active, so as long as you gate unloads or modifications on the existing active count it seems fine? > * @cfgfs_subsys: configfs subsystem used to manage configurations. > * @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs. > * @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs. > @@ -50,6 +51,7 @@ struct cscfg_manager { > struct list_head config_desc_list; > struct list_head load_order_list; > atomic_t sys_active_cnt; > + atomic_t sys_enable_cnt; > struct configfs_subsystem cfgfs_subsys; > u32 sysfs_active_config; > int sysfs_active_preset;