From: Zicheng Qu <quzicheng@huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10133 ------------------------ vstream_get_by_user_stream_id() stores the matched vstream in a static local variable that is never reset. When no entry matches the requested user_stream_id, the function returns the value left over from a previous call instead of NULL. If that vstream has been freed in the meantime, logic_cq_alloc() receives a dangling pointer and dereferences it (vstream->xcu and vstream->logic_vcq_id), producing a use-after-free that can be triggered from userspace via the vstream_manage syscall. Track whether the lookup matched in a local flag and return NULL when it did not, so that no stale pointer can escape the lookup. Fixes: 8dde1f2e6bf6 ("xsched: Introduce vstream management") Signed-off-by: Zicheng Qu <quzicheng@huawei.com> Signed-off-by: Tang Hui <tanghui20@huawei.com> --- kernel/xsched/vstream.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/kernel/xsched/vstream.c b/kernel/xsched/vstream.c index 074d030b14f1f..e7574236b363e 100644 --- a/kernel/xsched/vstream.c +++ b/kernel/xsched/vstream.c @@ -366,17 +366,23 @@ vstream_get_by_user_stream_id(struct xsched_cu *xcu, uint32_t user_stream_id) { int id; static vstream_info_t *ret; + int ret_valid = 0; mutex_lock(&xcu->vs_array_lock); for (id = 0; id < MAX_VSTREAM_NUM; id++) { if (xcu->vs_array[id] != NULL && xcu->vs_array[id]->id == user_stream_id) { ret = xcu->vs_array[id]; + ret_valid = 1; break; } } mutex_unlock(&xcu->vs_array_lock); - return ret; + + if (ret_valid) + return ret; + else + return NULL; } static int vstream_bind_to_xcu(vstream_info_t *vstream_info) @@ -507,8 +513,13 @@ static int logic_cq_alloc(struct vstream_args *arg) vstream = vstream_get_by_user_stream_id(xcu_found, logic_cq_alloc_para->user_stream_id); - if (vstream) - xcu_found = vstream->xcu; + + if (!vstream) { + XSCHED_ERR("Invalid stream id.\n"); + return -EINVAL; + } + + xcu_found = vstream->xcu; params.group = xcu_found->group; params.fd = arg->fd; params.payload = arg->payload; @@ -518,8 +529,7 @@ static int logic_cq_alloc(struct vstream_args *arg) XSCHED_ERR("Fail to alloc logic CQ memory to a vstream.\n"); return err; } - if (vstream) - vstream->logic_vcq_id = logic_cq_id; + vstream->logic_vcq_id = logic_cq_id; return 0; } -- 2.34.1

From: Zicheng Qu <quzicheng@huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10133 ------------------------ vstream_hbm_free() returned -ENOENT when no context was found for the current task, turning what should be a no-op free into an error. Align it with vstream_hbm_cleanup(): skip the free when there is no context and return success. Also initialise ret so that the early-exit path returns a defined value. Fixes: f6d8e9b654d6 ("xSched/dmem: introduce xsched_dmem_free()") Signed-off-by: Zicheng Qu <quzicheng@huawei.com> Signed-off-by: Tang Hui <tanghui20@huawei.com> --- kernel/xsched/vstream.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/kernel/xsched/vstream.c b/kernel/xsched/vstream.c index e7574236b363e..57b5a1746c289 100644 --- a/kernel/xsched/vstream.c +++ b/kernel/xsched/vstream.c @@ -680,7 +680,7 @@ static int vstream_hbm_free(struct vstream_args *arg) { struct xsched_cu *xcu_found; struct xsched_context *ctx; - int ret; + int ret = 0; if (!dmem_cgroup_enabled()) return -EPERM; @@ -695,14 +695,11 @@ static int vstream_hbm_free(struct vstream_args *arg) kref_get(&ctx->kref); mutex_unlock(&xcu_found->ctx_list_lock); - if (!ctx) { - XSCHED_ERR("Failed to find a context for HBM free"); - return -ENOENT; + if (ctx) { + ret = xsched_dmem_free(ctx, arg); + kref_put(&ctx->kref, xsched_task_free); } - ret = xsched_dmem_free(ctx, arg); - kref_put(&ctx->kref, xsched_task_free); - return ret; } -- 2.34.1