From nobody Wed Sep 04 20:29:48 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WzYy45NKWz5VKcS; Wed, 04 Sep 2024 20:29:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WzYy43Y3Nz4JZ9; Wed, 4 Sep 2024 20:29:48 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725481788; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YzmQIheVXA372VflWuFQ5yoXlhu97nAXE4uGdSV+2C0=; b=iyWwsOjuB9CrHlHCJJPwfaQDaB7gie9GBVn42XGCNI42gpsskT6DuoU8BFoPOL2TTUzRWp 8wkvetTvio1Mg2R69LUld4yH8bdEg0OpAiCP908R3kvIe7ZoZn9XrwutgtoTvBchkUCwVY Hc0e3H1+u1UMyLB4JOatsXJAtp44PHQXa7JHdZUm67Cfdt6p5U3UHEtessWKVikQH/Nsgg O+2OXLBtPCTfcYeEacZrO/wpOUK7LExx5j9pp3T+B2PpGZV8R0aXE/unB9sqNPzw/IC0Rj DMZRjOBEQHsEQ6MDc/LcYUUtqGaL/Z0aSshQumA+9ExGoEff2LxbH46jNDpnrg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725481788; a=rsa-sha256; cv=none; b=lF6NvsT1/fO+lcBqw74+XCI9CXNt4u0vvYE3zK6IJfmzikSYjdJUrf7qCxL4XcsBgjir3Z uHL3R2+gNSI1Jl0zpqd/EAfdVWrvAbChRvMNzwohb28rr0fZXPWqSn2Nax+5/n+sPcy/8a XCLy/tDGuHKGu8vRJf0lnyGnRAjKqGm8r1tv1VNj7zDdeOWbhGTS3qzSqxEKy5HWsoeybO VQIplM1qwxdVGnfnhBrmRw+1swGtk38zpRz0WqdDfpbl0L0kTr439+a+Lte71I6ZHz3BVH ZY9LRCK2ATF4NSU7qD5nI76srJwtvuRIFOMJmK1ltjCCzsVvk+6yGAkMoYCSyA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725481788; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YzmQIheVXA372VflWuFQ5yoXlhu97nAXE4uGdSV+2C0=; b=lzMRi/SXu6LjOV7qdT/GzXIFKlBw+BlLvhw1tAXHYS6ORW0OXPdY8kVSOa6aTgyN0pvZ+6 iz0xVJDrn8wzvgd55df+Lab9P835l8En+HUvixHCBgJThdU3v1WTuQtRZJ4NAWg2+V9+64 8NeSSD4YR1t8a4fHuGygSVqnd1czUhVDRCRIdKOhT0OI6fejbMyK2OdoFTyylUs2rYs0gu Z1TOcUKxDiPcBrPM5yjiwSubDvSlpGnySfdwNXXcmxRuc3tg0sXGTj2LYcwBPp7fTk699z c+t7Dbn6Ijuz/kLFcA7mLwuy2QQI+itTpQEP/fomP/cIyMc6nTLNa9ckakpANQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WzYy439Z0zdyH; Wed, 4 Sep 2024 20:29:48 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 484KTmxq082859; Wed, 4 Sep 2024 20:29:48 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 484KTm2i082856; Wed, 4 Sep 2024 20:29:48 GMT (envelope-from git) Date: Wed, 4 Sep 2024 20:29:48 GMT Message-Id: <202409042029.484KTm2i082856@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 01a7233a398a - releng/13.3 - umtx: shm: Fix use-after-free due to multiple drops of the registry reference List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/releng/13.3 X-Git-Reftype: branch X-Git-Commit: 01a7233a398a599827c25c84d1ce5ae4fe05e764 Auto-Submitted: auto-generated The branch releng/13.3 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=01a7233a398a599827c25c84d1ce5ae4fe05e764 commit 01a7233a398a599827c25c84d1ce5ae4fe05e764 Author: Olivier Certner AuthorDate: 2024-09-04 14:38:12 +0000 Commit: Ed Maste CommitDate: 2024-09-04 20:29:29 +0000 umtx: shm: Fix use-after-free due to multiple drops of the registry reference umtx_shm_unref_reg_locked() would unconditionally drop the "registry" reference, tied to USHMF_LINKED. This is not a problem for caller umtx_shm_object_terminated(), which operates under the 'umtx_shm_lock' lock end-to-end, but it is for indirect caller umtx_shm(), which drops the lock between umtx_shm_find_reg() and the call to umtx_shm_unref_reg(true) that deregisters the umtx shared region (from 'umtx_shm_registry'; umtx_shm_find_reg() only finds registered shared mutexes). Thus, two concurrent user-space callers of _umtx_op() with UMTX_OP_SHM and flags UMTX_SHM_DESTROY, both progressing past umtx_shm_find_reg() but before umtx_shm_unref_reg(true), would then decrease twice the reference count for the single reference standing for the shared mutex's registration. Reported by: Synacktiv Reviewed by: kib Approved by: emaste (mentor) Security: FreeBSD-SA-24:14.umtx Security: CVE-2024-43102 Security: CAP-01 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46126 (cherry picked from commit 62f40433ab47ad4a9694a22a0313d57661502ca1) (cherry picked from commit be7dc4613909e528e8b4ea8aaa3ae3aa62bec1ed) (cherry picked from commit 40615bcae9e7f41ca857c773e804db9bd7269581) Approved by: so --- sys/kern/kern_umtx.c | 51 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/sys/kern/kern_umtx.c b/sys/kern/kern_umtx.c index 0ab5d16503ad..7f13dd80080a 100644 --- a/sys/kern/kern_umtx.c +++ b/sys/kern/kern_umtx.c @@ -4380,39 +4380,49 @@ umtx_shm_free_reg(struct umtx_shm_reg *reg) } static bool -umtx_shm_unref_reg_locked(struct umtx_shm_reg *reg, bool force) +umtx_shm_unref_reg_locked(struct umtx_shm_reg *reg, bool linked_ref) { - bool res; - mtx_assert(&umtx_shm_lock, MA_OWNED); KASSERT(reg->ushm_refcnt > 0, ("ushm_reg %p refcnt 0", reg)); - reg->ushm_refcnt--; - res = reg->ushm_refcnt == 0; - if (res || force) { - if ((reg->ushm_flags & USHMF_LINKED) != 0) { - TAILQ_REMOVE(&umtx_shm_registry[reg->ushm_key.hash], - reg, ushm_reg_link); - LIST_REMOVE(reg, ushm_obj_link); - reg->ushm_flags &= ~USHMF_LINKED; - } + + if (linked_ref) { + if ((reg->ushm_flags & USHMF_LINKED) == 0) + /* + * The reference tied to USHMF_LINKED has already been + * released concurrently. + */ + return (false); + + TAILQ_REMOVE(&umtx_shm_registry[reg->ushm_key.hash], reg, + ushm_reg_link); + LIST_REMOVE(reg, ushm_obj_link); + reg->ushm_flags &= ~USHMF_LINKED; } - return (res); + + reg->ushm_refcnt--; + return (reg->ushm_refcnt == 0); } static void -umtx_shm_unref_reg(struct umtx_shm_reg *reg, bool force) +umtx_shm_unref_reg(struct umtx_shm_reg *reg, bool linked_ref) { vm_object_t object; bool dofree; - if (force) { + if (linked_ref) { + /* + * Note: This may be executed multiple times on the same + * shared-memory VM object in presence of concurrent callers + * because 'umtx_shm_lock' is not held all along in umtx_shm() + * and here. + */ object = reg->ushm_obj->shm_object; VM_OBJECT_WLOCK(object); vm_object_set_flag(object, OBJ_UMTXDEAD); VM_OBJECT_WUNLOCK(object); } mtx_lock(&umtx_shm_lock); - dofree = umtx_shm_unref_reg_locked(reg, force); + dofree = umtx_shm_unref_reg_locked(reg, linked_ref); mtx_unlock(&umtx_shm_lock); if (dofree) umtx_shm_free_reg(reg); @@ -4465,7 +4475,6 @@ umtx_shm_create_reg(struct thread *td, const struct umtx_key *key, if (!chgumtxcnt(cred->cr_ruidinfo, 1, lim_cur(td, RLIMIT_UMTXP))) return (ENOMEM); reg = uma_zalloc(umtx_shm_reg_zone, M_WAITOK | M_ZERO); - reg->ushm_refcnt = 1; bcopy(key, ®->ushm_key, sizeof(*key)); reg->ushm_obj = shm_alloc(td->td_ucred, O_RDWR, false); reg->ushm_cred = crhold(cred); @@ -4482,11 +4491,17 @@ umtx_shm_create_reg(struct thread *td, const struct umtx_key *key, *res = reg1; return (0); } - reg->ushm_refcnt++; TAILQ_INSERT_TAIL(&umtx_shm_registry[key->hash], reg, ushm_reg_link); LIST_INSERT_HEAD(USHM_OBJ_UMTX(key->info.shared.object), reg, ushm_obj_link); reg->ushm_flags = USHMF_LINKED; + /* + * This is one reference for the registry and the list of shared + * mutexes referenced by the VM object containing the lock pointer, and + * another for the caller, which it will free after use. So, one of + * these is tied to the presence of USHMF_LINKED. + */ + reg->ushm_refcnt = 2; mtx_unlock(&umtx_shm_lock); *res = reg; return (0);