Re: [PATCH 1/1] coresight: prevent deactivate active config while enable the config

[Suzuki K Poulose <suzuki.poulose@arm.com>]

Hi Yeo,


On 31/12/2024 14:37, Yeo Reum Yun wrote:
> Gentle ping in case of forgotten.
> 

Gentle reminder: Please avoid top posting.

I thought there is a v2 of this one ? I am now confused.

Kind regards
Suzuki

> ________________________________________
> From: Yeoreum Yun <yeoreum.yun@arm.com>
> Sent: 18 December 2024 08:48
> To: Suzuki Poulose; mike.leach@linaro.org; james.clark@linaro.org; alexander.shishkin@linux.intel.com
> Cc: coresight@lists.linaro.org; linux-arm-kernel@lists.infradead.org; linux-kernel@vger.kernel.org; nd; Yeo Reum Yun
> Subject: [PATCH 1/1] coresight: prevent deactivate active config while enable the config
> 
> While enable active config via cscfg_csdev_enable_active_config(),
> active config could be deactivated via configfs' sysfs interface.
> This could make UAF issue in below scenario:
> 
> CPU0                                          CPU1
> (perf or sysfs enable)                        load module
>                                                cscfg_load_config_sets()
>                                                activate config. // sysfs
>                                                (sys_active_cnt == 1)
> ...
> cscfg_csdev_enable_active_config()
>    lock(csdev->cscfg_csdev_lock)
>    // here load config activate by CPU1
>    unlock(csdev->cscfg_csdev_lock)
> 
>                                                deactivate config // sysfs
>                                                (sys_activec_cnt == 0)
>                                                cscfg_unload_config_sets()
>                                                unload module
> 
>    // access to config_desc which freed
>    // while unloading module.
>    cfs_csdev_enable_config
> 
> To address this, introduce sys_enable_cnt in cscfg_mgr to prevent
> deactivate while there is enabled configuration.
> 
> Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
> ---
>   .../hwtracing/coresight/coresight-etm4x-core.c |  3 +++
>   drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++--
>   drivers/hwtracing/coresight/coresight-syscfg.h |  2 ++
>   3 files changed, 21 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
> index 86893115df17..6218ef40acbc 100644
> --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
> +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
> @@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev)
>          smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1);
> 
>          raw_spin_unlock(&drvdata->spinlock);
> +
> +       cscfg_csdev_disable_active_config(csdev);
> +
>          cpus_read_unlock();
> 
>          /*
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
> index a70c1454b410..dfa7dcbaf25d 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.c
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c
> @@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti
>                          cscfg_mgr->sysfs_active_config = cfg_hash;
>          } else {
>                  /* disable if matching current value */
> -               if (cscfg_mgr->sysfs_active_config == cfg_hash) {
> +               if (cscfg_mgr->sysfs_active_config == cfg_hash &&
> +                   !atomic_read(&cscfg_mgr->sys_enable_cnt)) {
>                          _cscfg_deactivate_config(cfg_hash);
>                          cscfg_mgr->sysfs_active_config = 0;
>                  } else
> @@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
>          if (!atomic_read(&cscfg_mgr->sys_active_cnt))
>                  return 0;
> 
> +       /*
> +        * increment sys_enable_cnt first to prevent deactivate the config
> +        * while enable active config.
> +        */
> +       atomic_inc(&cscfg_mgr->sys_enable_cnt);
> +
>          /*
>           * Look for matching configuration - set the active configuration
>           * context if found.
> @@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
>                          raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
>                  }
>          }
> +
> +       if (!config_csdev_active || err)
> +               atomic_dec(&cscfg_mgr->sys_enable_cnt);
> +
>          return err;
>   }
>   EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config);
> @@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev)
>          if (config_csdev) {
>                  if (!config_csdev->enabled)
>                          config_csdev = NULL;
> -               else
> +               else {
>                          config_csdev->enabled = false;
> +                       atomic_dec(&cscfg_mgr->sys_enable_cnt);
> +               }
>          }
>          csdev->active_cscfg_ctxt = NULL;
>          raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
> @@ -1179,6 +1192,7 @@ static int cscfg_create_device(void)
>          INIT_LIST_HEAD(&cscfg_mgr->config_desc_list);
>          INIT_LIST_HEAD(&cscfg_mgr->load_order_list);
>          atomic_set(&cscfg_mgr->sys_active_cnt, 0);
> +       atomic_set(&cscfg_mgr->sys_enable_cnt, 0);
>          cscfg_mgr->load_state = CSCFG_NONE;
> 
>          /* setup the device */
> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h
> index 66e2db890d82..2fc397919985 100644
> --- a/drivers/hwtracing/coresight/coresight-syscfg.h
> +++ b/drivers/hwtracing/coresight/coresight-syscfg.h
> @@ -38,6 +38,7 @@ enum cscfg_load_ops {
>    * @config_desc_list:  List of system configuration descriptors to load into registered devices.
>    * @load_order_list:    Ordered list of owners for dynamically loaded configurations.
>    * @sys_active_cnt:    Total number of active config descriptor references.
> + * @sys_enable_cnt:    Total number of enable of active config descriptor references.
>    * @cfgfs_subsys:      configfs subsystem used to manage configurations.
>    * @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs.
>    * @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs.
> @@ -50,6 +51,7 @@ struct cscfg_manager {
>          struct list_head config_desc_list;
>          struct list_head load_order_list;
>          atomic_t sys_active_cnt;
> +       atomic_t sys_enable_cnt;
>          struct configfs_subsystem cfgfs_subsys;
>          u32 sysfs_active_config;
>          int sysfs_active_preset;
> --
> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}
>