76 lines
3.0 KiB
Diff
Executable File
76 lines
3.0 KiB
Diff
Executable File
From de9fa534e9a9170f8c9ad34eef529d7c7052dd6f Mon Sep 17 00:00:00 2001
|
|
Subject: [PATCH] GPUCORE-45689 fix page-isolation/page-free race
|
|
|
|
Prior to this change, the kbase_free_pages_worker would unlock each
|
|
to-be-freed page before freeing the page metadata associated with it,
|
|
which is performed by kbase_free_page_metadata. A page isolation by
|
|
the kernel, in another thread, could thus perform a page isolation
|
|
operation at the same time as the metadata was being freed, causing
|
|
a user-after-free. This patch therefore extends the period in which
|
|
the page is locked until the metadata is freed.
|
|
|
|
Unfortunately, a second issue also exists: the MMU function
|
|
kbase_mmu_mark_non_movable() fails to remove the migration ops
|
|
struct from a page when marking it non-movable. This exposes the
|
|
above issue, potentially allowing a non-movable pgd page to be
|
|
isolated while also being freed simulteneously, resulting in a
|
|
use-after-free vulnerability.
|
|
---
|
|
|
|
diff --git a/kernel/drivers/gpu/arm/midgard/mali_kbase_mem_migrate.c b/kernel/drivers/gpu/arm/midgard/mali_kbase_mem_migrate.c
|
|
index 3be79b6..8be1c9b 100644
|
|
--- a/kernel/drivers/gpu/arm/midgard/mali_kbase_mem_migrate.c
|
|
+++ b/kernel/drivers/gpu/arm/midgard/mali_kbase_mem_migrate.c
|
|
@@ -1,7 +1,7 @@
|
|
// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
|
|
/*
|
|
*
|
|
- * (C) COPYRIGHT 2022-2024 ARM Limited. All rights reserved.
|
|
+ * (C) COPYRIGHT 2022-2025 ARM Limited. All rights reserved.
|
|
*
|
|
* This program is free software and is provided to you under the terms of the
|
|
* GNU General Public License version 2 as published by the Free Software
|
|
@@ -157,9 +157,8 @@
|
|
__ClearPageMovable(p);
|
|
page_md->status = PAGE_MOVABLE_CLEAR(page_md->status);
|
|
}
|
|
- unlock_page(p);
|
|
-
|
|
kbase_free_page_metadata(kbdev, p, &group_id);
|
|
+ unlock_page(p);
|
|
kbdev->mgm_dev->ops.mgm_free_page(kbdev->mgm_dev, group_id, p, 0);
|
|
}
|
|
}
|
|
diff --git a/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c b/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
index e874790..7c744ba 100644
|
|
--- a/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
+++ b/kernel/drivers/gpu/arm/midgard/mmu/mali_kbase_mmu.c
|
|
@@ -1,7 +1,7 @@
|
|
// SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note
|
|
/*
|
|
*
|
|
- * (C) COPYRIGHT 2010-2024 ARM Limited. All rights reserved.
|
|
+ * (C) COPYRIGHT 2010-2025 ARM Limited. All rights reserved.
|
|
*
|
|
* This program is free software and is provided to you under the terms of the
|
|
* GNU General Public License version 2 as published by the Free Software
|
|
@@ -4509,6 +4509,8 @@
|
|
if (!kbase_is_page_migration_enabled())
|
|
return;
|
|
|
|
+ lock_page(page);
|
|
+
|
|
/* Composite large-page is excluded from migration, trigger a warn if a development
|
|
* wrongly leads to it.
|
|
*/
|
|
@@ -4524,7 +4526,9 @@
|
|
if (IS_PAGE_MOVABLE(page_md->status))
|
|
page_md->status = PAGE_MOVABLE_CLEAR(page_md->status);
|
|
|
|
+ __ClearPageMovable(page);
|
|
spin_unlock(&page_md->migrate_lock);
|
|
+ unlock_page(page);
|
|
}
|
|
|
|
int kbase_mmu_init(struct kbase_device *const kbdev, struct kbase_mmu_table *const mmut,
|