Re: [PATCH 1/1] coresight: prevent deactivate active config while enable the config
From: Suzuki K Poulose
Date: Mon Jan 06 2025 - 10:24:25 EST
On 06/01/2025 13:41, Yeo Reum Yun wrote:
Hi Suzuki,
Sorry this ping was my mistake.
As you said, v2 is the recent one.
You can ignore this.
Thanks, will respond on v2.
Also, fyi, your emails not plain text ! Please fix your email client.
Suzuki
Thanks!
------------------------------------------------------------------------
*보낸 사람:* Suzuki K Poulose <suzuki.poulose@xxxxxxx>
*보낸 날짜:* Monday, January 6, 2025 1:37:40 PM
*받는 사람:* Yeo Reum Yun <YeoReum.Yun@xxxxxxx>; mike.leach@xxxxxxxxxx
<mike.leach@xxxxxxxxxx>; james.clark@xxxxxxxxxx
<james.clark@xxxxxxxxxx>; alexander.shishkin@xxxxxxxxxxxxxxx
<alexander.shishkin@xxxxxxxxxxxxxxx>
*참조:* coresight@xxxxxxxxxxxxxxxx <coresight@xxxxxxxxxxxxxxxx>; linux-
arm-kernel@xxxxxxxxxxxxxxxxxxx <linux-arm-kernel@xxxxxxxxxxxxxxxxxxx>;
linux-kernel@xxxxxxxxxxxxxxx <linux-kernel@xxxxxxxxxxxxxxx>; nd <nd@xxxxxxx>
*제목:* Re: [PATCH 1/1] coresight: prevent deactivate active config
while enable the config
Hi Yeo,
On 31/12/2024 14:37, Yeo Reum Yun wrote:
Gentle ping in case of forgotten.
Gentle reminder: Please avoid top posting.
I thought there is a v2 of this one ? I am now confused.
Kind regards
Suzuki
________________________________________
From: Yeoreum Yun <yeoreum.yun@xxxxxxx>
Sent: 18 December 2024 08:48
To: Suzuki Poulose; mike.leach@xxxxxxxxxx; james.clark@xxxxxxxxxx; alexander.shishkin@xxxxxxxxxxxxxxx
Cc: coresight@xxxxxxxxxxxxxxxx; linux-arm-kernel@xxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; nd; Yeo Reum Yun
Subject: [PATCH 1/1] coresight: prevent deactivate active config while enable the config
While enable active config via cscfg_csdev_enable_active_config(),
active config could be deactivated via configfs' sysfs interface.
This could make UAF issue in below scenario:
CPU0 CPU1
(perf or sysfs enable) load module
cscfg_load_config_sets()
activate config. // sysfs
(sys_active_cnt == 1)
...
cscfg_csdev_enable_active_config()
lock(csdev->cscfg_csdev_lock)
// here load config activate by CPU1
unlock(csdev->cscfg_csdev_lock)
deactivate config // sysfs
(sys_activec_cnt == 0)
cscfg_unload_config_sets()
unload module
// access to config_desc which freed
// while unloading module.
cfs_csdev_enable_config
To address this, introduce sys_enable_cnt in cscfg_mgr to prevent
deactivate while there is enabled configuration.
Signed-off-by: Yeoreum Yun <yeoreum.yun@xxxxxxx>
---
.../hwtracing/coresight/coresight-etm4x-core.c | 3 +++
drivers/hwtracing/coresight/coresight-syscfg.c | 18 ++++++++++++++++--
drivers/hwtracing/coresight/coresight-syscfg.h | 2 ++
3 files changed, 21 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c
index 86893115df17..6218ef40acbc 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c
@@ -986,6 +986,9 @@ static void etm4_disable_sysfs(struct coresight_device *csdev)
smp_call_function_single(drvdata->cpu, etm4_disable_hw, drvdata, 1);
raw_spin_unlock(&drvdata->spinlock);
+
+ cscfg_csdev_disable_active_config(csdev);
+
cpus_read_unlock();
/*
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.c b/drivers/hwtracing/coresight/coresight-syscfg.c
index a70c1454b410..dfa7dcbaf25d 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.c
+++ b/drivers/hwtracing/coresight/coresight-syscfg.c
@@ -953,7 +953,8 @@ int cscfg_config_sysfs_activate(struct cscfg_config_desc *config_desc, bool acti
cscfg_mgr->sysfs_active_config = cfg_hash;
} else {
/* disable if matching current value */
- if (cscfg_mgr->sysfs_active_config == cfg_hash) {
+ if (cscfg_mgr->sysfs_active_config == cfg_hash &&
+ !atomic_read(&cscfg_mgr->sys_enable_cnt)) {
_cscfg_deactivate_config(cfg_hash);
cscfg_mgr->sysfs_active_config = 0;
} else
@@ -1055,6 +1056,12 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
if (!atomic_read(&cscfg_mgr->sys_active_cnt))
return 0;
+ /*
+ * increment sys_enable_cnt first to prevent deactivate the config
+ * while enable active config.
+ */
+ atomic_inc(&cscfg_mgr->sys_enable_cnt);
+
/*
* Look for matching configuration - set the active configuration
* context if found.
@@ -1098,6 +1105,10 @@ int cscfg_csdev_enable_active_config(struct coresight_device *csdev,
raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
}
}
+
+ if (!config_csdev_active || err)
+ atomic_dec(&cscfg_mgr->sys_enable_cnt);
+
return err;
}
EXPORT_SYMBOL_GPL(cscfg_csdev_enable_active_config);
@@ -1129,8 +1140,10 @@ void cscfg_csdev_disable_active_config(struct coresight_device *csdev)
if (config_csdev) {
if (!config_csdev->enabled)
config_csdev = NULL;
- else
+ else {
config_csdev->enabled = false;
+ atomic_dec(&cscfg_mgr->sys_enable_cnt);
+ }
}
csdev->active_cscfg_ctxt = NULL;
raw_spin_unlock_irqrestore(&csdev->cscfg_csdev_lock, flags);
@@ -1179,6 +1192,7 @@ static int cscfg_create_device(void)
INIT_LIST_HEAD(&cscfg_mgr->config_desc_list);
INIT_LIST_HEAD(&cscfg_mgr->load_order_list);
atomic_set(&cscfg_mgr->sys_active_cnt, 0);
+ atomic_set(&cscfg_mgr->sys_enable_cnt, 0);
cscfg_mgr->load_state = CSCFG_NONE;
/* setup the device */
diff --git a/drivers/hwtracing/coresight/coresight-syscfg.h b/drivers/hwtracing/coresight/coresight-syscfg.h
index 66e2db890d82..2fc397919985 100644
--- a/drivers/hwtracing/coresight/coresight-syscfg.h
+++ b/drivers/hwtracing/coresight/coresight-syscfg.h
@@ -38,6 +38,7 @@ enum cscfg_load_ops {
* @config_desc_list: List of system configuration descriptors to load into registered devices.
* @load_order_list: Ordered list of owners for dynamically loaded configurations.
* @sys_active_cnt: Total number of active config descriptor references.
+ * @sys_enable_cnt: Total number of enable of active config descriptor references.
* @cfgfs_subsys: configfs subsystem used to manage configurations.
* @sysfs_active_config:Active config hash used if CoreSight controlled from sysfs.
* @sysfs_active_preset:Active preset index used if CoreSight controlled from sysfs.
@@ -50,6 +51,7 @@ struct cscfg_manager {
struct list_head config_desc_list;
struct list_head load_order_list;
atomic_t sys_active_cnt;
+ atomic_t sys_enable_cnt;
struct configfs_subsystem cfgfs_subsys;
u32 sysfs_active_config;
int sysfs_active_preset;
--
LEVI:{C3F47F37-75D8-414A-A8BA-3980EC8A46D7}