Re: [PATCH v2] coresight: prevent deactivate active config while enable the config

Hi Levi

On 23/12/2024 18:53, Yeoreum Yun wrote:

While enable active config via cscfg_csdev_enable_active_config(), active config could be deactivated via configfs' sysfs interface. This could make UAF issue in below scenario:

CPU0 CPU1 (sysfs enable) load module cscfg_load_config_sets() activate config. // sysfs (sys_active_cnt == 1) ... cscfg_csdev_enable_active_config() lock(csdev->cscfg_csdev_lock) // here load config activate by CPU1 unlock(csdev->cscfg_csdev_lock)

                                           deactivate config // sysfs
                                           (sys_activec_cnt == 0)
                                           cscfg_unload_config_sets()
                                           unload module

// access to config_desc which freed // while unloading module. cfs_csdev_enable_config

To address this, introduce sys_enable_cnt in cscfg_mgr to prevent deactivate while there is enabled configuration.

Thanks for the finding the problem and the detailed description + patch. I have some concerns on the fix, please find it below.

So we have 3 atomic counters now ! cscfg_mgr->sys_active_cnt // Global count config->active_cnt // Per config count,

And another one which this one introduces.

cscfg_mgr->sys_enable_cnt // ?

And config->active_cnt is always ever 0 or 1. i.e., it is not really a reference counter at the moment but it indicates whether it is active or not. Could we not use that for tracking the references on the specific config ?

i.e., every time we "enable_active_config" atomic_inc(config->active_cnt)

and disable_active_config() always decrements the config. These could be wrapped in cscfg_get() cscfg_put() which would, inc/dec the refcounts and also drop the "module" reference when the active_cnt == 0

Signed-off-by: Yeoreum Yun yeoreum.yun@arm.com

from v1 to v2: - modify commit message.

---

.../hwtracing/coresight/coresight-etm4x-core.c | 3 +++ drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++-- drivers/hwtracing/coresight/coresight-syscfg.h | 2 ++ 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 86893115df17..6218ef40acbc 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev) smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1);

raw_spin_unlock(&drvdata->spinlock);

• cscfg_csdev_disable_active_config(csdev);

This looks like a separate "fix" from what you are trying to address. Please could split this ?

Also, would like to hear what Mike has to say about this change.

Suzuki

• cpus_read_unlock();

  /*

diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c index a70c1454b410..dfa7dcbaf25d 100644 --- a/drivers/hwtracing/coresight/coresight-syscfg.c +++ b/drivers/hwtracing/coresight/coresight-syscfg.c @@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti cscfg_mgr->sysfs_active_config = cfg_hash; } else { /* disable if matching current value */

• if (cscfg_mgr->sysfs_active_config == cfg_hash) {
  

• if (cscfg_mgr->sysfs_active_config == cfg_hash &&
  

•     !atomic_read(&cscfg_mgr->sys_enable_cnt)) {
  _cscfg_deactivate_config(cfg_hash);
  cscfg_mgr->sysfs_active_config = 0;
  

  } else

@@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, if (!atomic_read(&cscfg_mgr->sys_active_cnt)) return 0;

• /*

• * increment sys_enable_cnt first to prevent deactivate the config
  

• * while enable active config.
  

• */
  

• atomic_inc(&cscfg_mgr->sys_enable_cnt);
• /*
  • Look for matching configuration - set the active configuration
  • context if found.

@@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev, raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags); } }

• if (!config_csdev_active || err)

• atomic_dec(&cscfg_mgr->sys_enable_cnt);
  

• return err; } EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config);

@@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev) if (config_csdev) { if (!config_csdev->enabled) config_csdev = NULL;

• else
  

• else {
  config_csdev->enabled = false;
  

• 	atomic_dec(&cscfg_mgr->sys_enable_cnt);
  

• }
  

  } csdev->active_cscfg_ctxt = NULL; raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);

@@ -1179,6 +1192,7 @@ static int cscfg_create_device(void) INIT_LIST_HEAD(&cscfg_mgr->config_desc_list); INIT_LIST_HEAD(&cscfg_mgr->load_order_list); atomic_set(&cscfg_mgr->sys_active_cnt, 0);

• atomic_set(&cscfg_mgr->sys_enable_cnt, 0); cscfg_mgr->load_state = CSCFG_NONE;

  /* setup the device */

diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h index 66e2db890d82..2fc397919985 100644 --- a/drivers/hwtracing/coresight/coresight-syscfg.h +++ b/drivers/hwtracing/coresight/coresight-syscfg.h @@ -38,6 +38,7 @@ enum cscfg_load_ops {

• @config_desc_list: List of system configuration descriptors to load into registered devices.
• @load_order_list: Ordered list of owners for dynamically loaded configurations.
• @sys_active_cnt: Total number of active config descriptor references.

• • @sys_enable_cnt: Total number of enable of active config descriptor references.
  • @cfgfs_subsys: configfs subsystem used to manage configurations.
  • @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs.
  • @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs.

@@ -50,6 +51,7 @@ struct cscfg_manager { struct list_head config_desc_list; struct list_head load_order_list; atomic_t sys_active_cnt;

• atomic_t sys_enable_cnt; struct configfs_subsystem cfgfs_subsys; u32 sysfs_active_config; int sysfs_active_preset;

-- LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}