Re: [RFC PATCH v2 14/15] misc/arm-cla: Support exclusive context assignment

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] cla: missing KVM refcount failure handling causes UAF
--

commit 2dbcc26b5b7fa32dbb9707b12991d8ab79134d92
Author: Jean-Philippe Brucker <jpb@kernel.org>

misc/arm-cla: Support exclusive context assignment

This commit introduces a nr_contexts member to cla_domain to track mapped
contexts. It allows PL0 contexts to share the domain while enforcing
exclusive assignment for PL1 contexts by using a negative count.

> diff --git a/drivers/misc/arm-cla/cla-ctx.c b/drivers/misc/arm-cla/cla-ctx.c
> index 0489bf7a103f9..f956cc88909f8 100644
> --- a/drivers/misc/arm-cla/cla-ctx.c
> +++ b/drivers/misc/arm-cla/cla-ctx.c

[ ... ]

> @@ -116,6 +153,8 @@ struct cla_ctx *cla_ctx_create(struct cla_domain *domain,
>  		cla_ctx_put_pl1(ctx);
>  	}
>  	kfree(ctx);
> +err_put_domain:
> +	cla_domain_put(domain);
>  err_unlock:
>  	mutex_unlock(&domain->lock);
>  	return ERR_PTR(ret);

[Severity: High]
Earlier in cla_ctx_create(), if cla_ctx_get_pl1() fails to acquire a
reference to KVM (e.g., if the VM is being torn down concurrently and its
refcount is already zero), the failure is ignored:

	} else {
		WARN_ON(!cla_ctx_get_pl1(ctx));
	}

The context creation continues with a potentially freed KVM pointer. If an
error occurs later in the function (such as cla_mtc_get_ctx() failing) and
we take the err_free path, or when the context is eventually destroyed,
cla_ctx_put_pl1() is unconditionally called.

Does this cause a use-after-free and a refcount underflow of the kvm
object, since the reference was never actually acquired?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015142552.4128028-1-ryan.roberts@arm.com?part=14