[PATCH] ocxl: cancel xsl fault work before freeing the SPA to avoid use-after-free

[hyunjungg <hj351016@gmail.com>]

From: Hyunjung Ko <hj351016@gmail.com>

The XSL translation-fault interrupt handler schedules
spa->xsl_fault.fault_work (xsl_fault_handler_bh), which dereferences the
fault and the SPA (via container_of) and acks the interrupt. free_link()
calls release_xsl_irq() -- which frees the XSL interrupt so no new
fault_work can be scheduled -- and then free_spa(), which frees the SPA.
Neither cancels a fault_work that was already queued by the last
interrupt. As it runs on the system workqueue with no timing bound, it
can execute after the SPA has been freed, dereferencing freed memory --
a use-after-free.

Cancel the fault work in free_spa() before the SPA is freed. By that
point release_xsl_irq() has freed the interrupt, so the work cannot be
re-queued and cancel_work_sync() is sufficient. The interrupt top half
takes a reference on the faulting mm that the bottom half is expected to
release, so if cancel_work_sync() cancels a not-yet-run work, drop that
reference here to avoid leaking it.

Fixes: 5ef3166e8a32 ("ocxl: Driver code for 'generic' opencapi devices")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
---
 drivers/misc/ocxl/link.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/misc/ocxl/link.c b/drivers/misc/ocxl/link.c
index 7749dcd..1c2a89e 100644
--- a/drivers/misc/ocxl/link.c
+++ b/drivers/misc/ocxl/link.c
@@ -376,6 +376,15 @@ static void free_spa(struct ocxl_link *link)
 		link->dev);
 
 	if (spa && spa->spa_mem) {
+		/*
+		 * A pending xsl fault bottom half holds a reference on the
+		 * faulting mm (taken in the top half, released by the bottom
+		 * half). If we cancel it before it runs, drop that reference
+		 * here so it is not leaked. release_xsl_irq() has already
+		 * freed the xsl interrupt, so no new work can be scheduled.
+		 */
+		if (cancel_work_sync(&spa->xsl_fault.fault_work))
+			mmput(spa->xsl_fault.pe_data.mm);
 		free_pages((unsigned long) spa->spa_mem, spa->spa_order);
 		kfree(spa);
 		link->spa = NULL;
-- 
2.43.0