[PATCH] powerpc/64s: Fix VAS mm use after free

[PATCH] powerpc/64s: Fix VAS mm use after free

[Nicholas Piggin]

The refcount on mm is dropped before the coprocessor is detached.

Reported-by: Sachin Sant <sachinp@linux.ibm.com>
Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
How's this for fixing your vas_deallocate_window warning at
radix_tlb.c:991 ?

I added a few new warnings in the TLB flush code recently which is
why these new warns are showing up.

Thanks,
Nick

 arch/powerpc/platforms/powernv/vas-window.c | 2 +-
 arch/powerpc/platforms/pseries/vas.c        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/powernv/vas-window.c b/arch/powerpc/platforms/powernv/vas-window.c
index 0072682531d8..b664838008c1 100644
--- a/arch/powerpc/platforms/powernv/vas-window.c
+++ b/arch/powerpc/platforms/powernv/vas-window.c
@@ -1310,8 +1310,8 @@ int vas_win_close(struct vas_window *vwin)
 	/* if send window, drop reference to matching receive window */
 	if (window->tx_win) {
 		if (window->user_win) {
-			put_vas_user_win_ref(&vwin->task_ref);
 			mm_context_remove_vas_window(vwin->task_ref.mm);
+			put_vas_user_win_ref(&vwin->task_ref);
 		}
 		put_rx_win(window->rxwin);
 	}
diff --git a/arch/powerpc/platforms/pseries/vas.c b/arch/powerpc/platforms/pseries/vas.c
index 513180467562..9a44a98ba342 100644
--- a/arch/powerpc/platforms/pseries/vas.c
+++ b/arch/powerpc/platforms/pseries/vas.c
@@ -507,8 +507,8 @@ static int vas_deallocate_window(struct vas_window *vwin)
 	vascaps[win->win_type].nr_open_windows--;
 	mutex_unlock(&vas_pseries_mutex);
 
-	put_vas_user_win_ref(&vwin->task_ref);
 	mm_context_remove_vas_window(vwin->task_ref.mm);
+	put_vas_user_win_ref(&vwin->task_ref);
 
 	kfree(win);
 	return 0;
-- 
2.40.1

Re: [PATCH] powerpc/64s: Fix VAS mm use after free

[Sachin Sant]

> On 07-Jun-2023, at 3:40 PM, Nicholas Piggin <npiggin@gmail.com> wrote:
> 
> The refcount on mm is dropped before the coprocessor is detached.
> 
> Reported-by: Sachin Sant <sachinp@linux.ibm.com>
> Fixes: 7bc6f71bdff5f ("powerpc/vas: Define and use common vas_window struct")
> Fixes: b22f2d88e435c ("powerpc/pseries/vas: Integrate API with open/close windows")
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
> How's this for fixing your vas_deallocate_window warning at
> radix_tlb.c:991 ?
> 
> I added a few new warnings in the TLB flush code recently which is
> why these new warns are showing up.
> 

Thanks Nick. This fixes the reported warning.
Nx-gzip as well as mce error inject tests completed successfully.

Tested-by: Sachin Sant <sachinp@linux.ibm.com>

- Sachin

Re: [PATCH] powerpc/64s: Fix VAS mm use after free

[Michael Ellerman]

On Wed, 07 Jun 2023 20:10:24 +1000, Nicholas Piggin wrote:
> The refcount on mm is dropped before the coprocessor is detached.
> 
> 

Applied to powerpc/next.

[1/1] powerpc/64s: Fix VAS mm use after free
      https://git.kernel.org/powerpc/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331

cheers