From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 578B716A92E for ; Mon, 6 Jan 2025 15:23:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736177018; cv=none; b=mAad+ZA9TJ5DnhsbmZMBr5A7tOcLC5OIK2ow6zsFKKze554Ub81ba7FRiYXFc1H2O5dKbxQTaN6dz73YOUewzKWvmw9U1POEKxRDRMwc87LX7OsHsRIc19gwMhpH2+9hpgxiWpnORkZwMLM5rd3MD0nCbP0k5YOc52xgu83q2ZA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1736177018; c=relaxed/simple; bh=z98Pl2GzZOF+uCu3LFlUfIxJDjyV3wnYr5xaBXQsIyk=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Bab+ax129DKkUvqyUWHdDJLEIFLnskOR3C1Fr6kZAPA9Db/bZDKCuakJ9R0pgXf3VHQO0jgaG93KzXCRcZScJZ8p36iGpe0SbtpOURT+t539iYlHavcMmZCGKB96wem9yl1scAUS08WKf0iAJ5Ex204W+qCCopnJL/HFPDMOkGc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id F007E1476; Mon, 6 Jan 2025 07:24:03 -0800 (PST) Received: from [10.57.32.219] (unknown [10.57.32.219]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 84A823F7BD; Mon, 6 Jan 2025 07:23:34 -0800 (PST) Message-ID: Date: Mon, 6 Jan 2025 15:23:33 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] coresight: prevent deactivate active config while enable the config To: Yeo Reum Yun , "mike.leach@linaro.org" , "james.clark@linaro.org" , "alexander.shishkin@linux.intel.com" Cc: "coresight@lists.linaro.org" , "linux-arm-kernel@lists.infradead.org" , "linux-kernel@vger.kernel.org" , nd References: <20241218084833.609876-1-yeoreum.yun@arm.com> <208b72a1-06eb-4ac0-8104-20ae3f0cf174@arm.com> Content-Language: en-GB From: Suzuki K Poulose In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit On 06/01/2025 13:41, Yeo Reum Yun wrote: > Hi Suzuki, > > Sorry this ping was my mistake. > As you said, v2 is the recent one. > You can ignore this. > Thanks, will respond on v2. Also, fyi, your emails not plain text ! Please fix your email client. Suzuki > Thanks! > ------------------------------------------------------------------------ > *보낸 사람:* Suzuki K Poulose > *보낸 날짜:* Monday, January 6, 2025 1:37:40 PM > *받는 사람:* Yeo Reum Yun ; mike.leach@linaro.org > ; james.clark@linaro.org > ; alexander.shishkin@linux.intel.com > > *참조:* coresight@lists.linaro.org ; linux- > arm-kernel@lists.infradead.org ; > linux-kernel@vger.kernel.org ; nd > *제목:* Re: [PATCH 1/1] coresight: prevent deactivate active config > while enable the config > Hi Yeo, > > > On 31/12/2024 14:37, Yeo Reum Yun wrote: >> Gentle ping in case of forgotten. >> > > Gentle reminder: Please avoid top posting. > > I thought there is a v2 of this one ? I am now confused. > > Kind regards > Suzuki > >> ________________________________________ >> From: Yeoreum Yun >> Sent: 18 December 2024 08:48 >> To: Suzuki Poulose; mike.leach@linaro.org; james.clark@linaro.org; alexander.shishkin@linux.intel.com >> Cc: coresight@lists.linaro.org; linux-arm-kernel@lists.infradead.org; linux-kernel@vger.kernel.org; nd; Yeo Reum Yun >> Subject: [PATCH 1/1] coresight: prevent deactivate active config while enable the config >> >> While enable active config via cscfg_csdev_enable_active_config(), >> active config could be deactivated via configfs' sysfs interface. >> This could make UAF issue in below scenario: >> >> CPU0                                          CPU1 >> (perf or sysfs enable)                        load module >>                                                cscfg_load_config_sets() >>                                                activate config. // sysfs >>                                                (sys_active_cnt == 1) >> ... >> cscfg_csdev_enable_active_config() >>    lock(csdev->cscfg_csdev_lock) >>    // here load config activate by CPU1 >>    unlock(csdev->cscfg_csdev_lock) >> >>                                                deactivate config // sysfs >>                                                (sys_activec_cnt == 0) >>                                                cscfg_unload_config_sets() >>                                                unload module >> >>    // access to config_desc which freed >>    // while unloading module. >>    cfs_csdev_enable_config >> >> To address this, introduce sys_enable_cnt in cscfg_mgr to prevent >> deactivate while there is enabled configuration. >> >> Signed-off-by: Yeoreum Yun >> --- >>   .../hwtracing/coresight/coresight-etm4x-core.c |  3 +++ >>   drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++-- >>   drivers/hwtracing/coresight/coresight-syscfg.h |  2 ++ >>   3 files changed, 21 insertions(+), 2 deletions(-) >> >> diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c >> index 86893115df17..6218ef40acbc 100644 >> --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c >> +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c >> @@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev) >>          smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1); >> >>          raw_spin_unlock(&drvdata->spinlock); >> + >> +       cscfg_csdev_disable_active_config(csdev); >> + >>          cpus_read_unlock(); >> >>          /* >> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c >> index a70c1454b410..dfa7dcbaf25d 100644 >> --- a/drivers/hwtracing/coresight/coresight-syscfg.c >> +++ b/drivers/hwtracing/coresight/coresight-syscfg.c >> @@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti >>                          cscfg_mgr->sysfs_active_config = cfg_hash; >>          } else { >>                  /* disable if matching current value */ >> -               if (cscfg_mgr->sysfs_active_config == cfg_hash) { >> +               if (cscfg_mgr->sysfs_active_config == cfg_hash && >> +                   !atomic_read(&cscfg_mgr->sys_enable_cnt)) { >>                          _cscfg_deactivate_config(cfg_hash); >>                          cscfg_mgr->sysfs_active_config = 0; >>                  } else >> @@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, >>          if (!atomic_read(&cscfg_mgr->sys_active_cnt)) >>                  return 0; >> >> +       /* >> +        * increment sys_enable_cnt first to prevent deactivate the config >> +        * while enable active config. >> +        */ >> +       atomic_inc(&cscfg_mgr->sys_enable_cnt); >> + >>          /* >>           * Look for matching configuration - set the active configuration >>           * context if found. >> @@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, >>                          raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); >>                  } >>          } >> + >> +       if (!config_csdev_active || err) >> +               atomic_dec(&cscfg_mgr->sys_enable_cnt); >> + >>          return err; >>   } >>   EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config); >> @@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev) >>          if (config_csdev) { >>                  if (!config_csdev->enabled) >>                          config_csdev = NULL; >> -               else >> +               else { >>                          config_csdev->enabled = false; >> +                       atomic_dec(&cscfg_mgr->sys_enable_cnt); >> +               } >>          } >>          csdev->active_cscfg_ctxt = NULL; >>          raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); >> @@ -1179,6 +1192,7 @@ static int cscfg_create_device(void) >>          INIT_LIST_HEAD(&cscfg_mgr->config_desc_list); >>          INIT_LIST_HEAD(&cscfg_mgr->load_order_list); >>          atomic_set(&cscfg_mgr->sys_active_cnt, 0); >> +       atomic_set(&cscfg_mgr->sys_enable_cnt, 0); >>          cscfg_mgr->load_state = CSCFG_NONE; >> >>          /* setup the device */ >> diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h >> index 66e2db890d82..2fc397919985 100644 >> --- a/drivers/hwtracing/coresight/coresight-syscfg.h >> +++ b/drivers/hwtracing/coresight/coresight-syscfg.h >> @@ -38,6 +38,7 @@ enum cscfg_load_ops { >>    * @config_desc_list:  List of system configuration descriptors to load into registered devices. >>    * @load_order_list:    Ordered list of owners for dynamically loaded configurations. >>    * @sys_active_cnt:    Total number of active config descriptor references. >> + * @sys_enable_cnt:    Total number of enable of active config descriptor references. >>    * @cfgfs_subsys:      configfs subsystem used to manage configurations. >>    * @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs. >>    * @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs. >> @@ -50,6 +51,7 @@ struct cscfg_manager { >>          struct list_head config_desc_list; >>          struct list_head load_order_list; >>          atomic_t sys_active_cnt; >> +       atomic_t sys_enable_cnt; >>          struct configfs_subsystem cfgfs_subsys; >>          u32 sysfs_active_config; >>          int sysfs_active_preset; >> -- >> LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7} >> >