[PATCH for-rc] RDMA/hfi1: Fix use-after-free bug for mm struct

[PATCH for-rc] RDMA/hfi1: Fix use-after-free bug for mm struct

[Dennis Dalessandro]

From: Douglas Miller <doug.miller@cornelisnetworks.com>

Under certain conditions, such as MPI_Abort, the hfi1 cleanup
code may represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is
freed before the final use in hfi1_release_user_pages().  A new task
may allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write().  Another is corruption of an mm struct that
is in use by another task.

Fixes: 3d2a9d642512 ("IB/hfi1: Ensure correct mm is used at all times")
Cc: <stable@vger.kernel.org>
Signed-off-by: Douglas Miller <doug.miller@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
---
 drivers/infiniband/hw/hfi1/mmu_rb.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/infiniband/hw/hfi1/mmu_rb.c b/drivers/infiniband/hw/hfi1/mmu_rb.c
index 876cc78..7333646 100644
--- a/drivers/infiniband/hw/hfi1/mmu_rb.c
+++ b/drivers/infiniband/hw/hfi1/mmu_rb.c
@@ -80,6 +80,9 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler)
 	unsigned long flags;
 	struct list_head del_list;
 
+	/* Prevent freeing of mm until we are completely finished. */
+	mmgrab(handler->mn.mm);
+
 	/* Unregister first so we don't get any more notifications. */
 	mmu_notifier_unregister(&handler->mn, handler->mn.mm);
 
@@ -102,6 +105,9 @@ void hfi1_mmu_rb_unregister(struct mmu_rb_handler *handler)
 
 	do_remove(handler, &del_list);
 
+	/* Now the mm may be freed. */
+	mmdrop(handler->mn.mm);
+
 	kfree(handler);
 }
 

Re: [PATCH for-rc] RDMA/hfi1: Fix use-after-free bug for mm struct

[Jason Gunthorpe]

On Fri, Apr 08, 2022 at 09:35:23AM -0400, Dennis Dalessandro wrote:
> From: Douglas Miller <doug.miller@cornelisnetworks.com>
> 
> Under certain conditions, such as MPI_Abort, the hfi1 cleanup
> code may represent the last reference held on the task mm.
> hfi1_mmu_rb_unregister() then drops the last reference and the mm is
> freed before the final use in hfi1_release_user_pages().  A new task
> may allocate the mm structure while it is still being used, resulting in
> problems. One manifestation is corruption of the mmap_sem counter leading
> to a hang in down_write().  Another is corruption of an mm struct that
> is in use by another task.
> 
> Fixes: 3d2a9d642512 ("IB/hfi1: Ensure correct mm is used at all times")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Douglas Miller <doug.miller@cornelisnetworks.com>
> Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
> ---
>  drivers/infiniband/hw/hfi1/mmu_rb.c |    6 ++++++
>  1 file changed, 6 insertions(+)

Applied to for-rc, thanks

Jason