Re: [PATCH v2] dmaengine: idxd: Fix use-after-free of idxd_wq

[Vinicius Costa Gomes <vinicius.gomes@intel.com>]

Vinicius Costa Gomes <vinicius.gomes@intel.com> writes:

> Guixin Liu <kanie@linux.alibaba.com> writes:
>
>> We found an idxd_wq use-after-free issue with kasan
>> when remove the idxd PCI device:
>>
>> BUG: KASAN: slab-use-after-free in idxd_device_drv_remove+0x1f8/0x240 [idxd]
>> Call Trace:
>>   <TASK>
>>   dump_stack_lvl+0x32/0x50
>>   print_address_description.constprop.0+0x2c/0x390
>>   ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>>   print_report+0xba/0x280
>>   ? kasan_addr_to_slab+0x9/0xa0
>>   ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>>   kasan_report+0xab/0xe0
>>   ? idxd_device_drv_remove+0x1f8/0x240 [idxd]
>>   idxd_device_drv_remove+0x1f8/0x240 [idxd]
>>   device_release_driver_internal+0x391/0x560
>>   bus_remove_device+0x1f5/0x3f0
>>   device_del+0x392/0x990
>>   ? __pfx_device_del+0x10/0x10
>>   ? kobject_cleanup+0x117/0x360
>>   ? idxd_unregister_devices+0x229/0x320 [idxd]
>>   device_unregister+0x13/0xa0
>>   idxd_remove+0x4f/0x1b0 [idxd]
>>   pci_device_remove+0xa7/0x1d0
>>   device_release_driver_internal+0x391/0x560
>>   ? pci_pme_active+0x1e/0x450
>>   pci_stop_bus_device+0x10a/0x150
>>   pci_stop_and_remove_bus_device_locked+0x16/0x30
>>   remove_store+0xcf/0xe0
>>
>> Freed by task 15535:
>>   kasan_save_stack+0x1c/0x40
>>   kasan_set_track+0x21/0x30
>>   kasan_save_free_info+0x27/0x40
>>   ____kasan_slab_free+0x171/0x240
>>   slab_free_freelist_hook+0xde/0x190
>>   __kmem_cache_free+0x19e/0x310
>>   device_release+0x98/0x210
>>   kobject_cleanup+0x102/0x360
>>   idxd_unregister_devices+0xb3/0x320 [idxd]
>>   dxd_remove+0x3f/0x1b0 [idxd]
>>   pci_device_remove+0xa7/0x1d0
>>   device_release_driver_internal+0x391/0x560
>>   pci_stop_bus_device+0x10a/0x150
>>   pci_stop_and_remove_bus_device_locked+0x16/0x30
>>   remove_store+0xcf/0xe0
>>
>> In the idxd_remove() flow, when execution reaches
>> idxd_unregister_devices(), all idxd_wq instances have already been
>> freed. Subsequently, when device_unregister(idxd_confdev(idxd)) is
>> executed, it calls into idxd_device_drv_remove() which accesses the
>> already-freed idxd_wq. This fix resolves the issue by calling
>> device_release_driver() before idxd_unregister_devices().
>>
>> Fixes: 98da0106aac0d ("dmanegine: idxd: fix resource free ordering on driver removal")
>> Co-developed-by: Shuai Xue <xueshuai@linux.alibaba.com>
>> Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
>> Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
>> ---
>
> All questions that I had after the AI review are handled:
>
> Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
>

Messing with /sys/bus/pci/drivers/idxd/unbind I was able to reproduce
this issue without KASAN (KASAN makes it 100% reproducible), so:

Tested-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>


Cheers,
-- 
Vinicius