From nobody Wed Sep 4 20:54:22 2024 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WzZVR1lX7z5VMxP; Wed, 04 Sep 2024 20:54:23 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WzZVQ5fN0z4QHw; Wed, 4 Sep 2024 20:54:22 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725483262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=I5tL08npTbZXefjy1vUW9hi6mevY9RDV8WaLS6SsFsk=; b=nkJgHvVOl5mY1KAy55hC1P942RbDQP8cAsMBsgXNSkSfh/UTmDByQKMzrwhCsG2uqOOl9a GXI3V/sIrW0flmzZ4Tn0IQckBeE0FSDg8OGHyt/JUTqesStFYU0nrMqSjIeXD5BcwC9FFy T1SNJaGpgqJMcHX8cvyok1R+8qe3ZDsj2/Idm5qR2vxt6BLKiRSXrYY0KE+AQGpAQ9O/9y xhXFVnMnk7KqoO015ymx5RNVeLCiMoFOQM6+f1TUfpGjI1HVsUK6tyk9iMotqs1kLM+fja PT306dGnyxULt4+9likZ8wm/ENwNGJo6jKTX81eUPBpi1oARB+SqQA8kVHVEWw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1725483262; a=rsa-sha256; cv=none; b=Lu7E02RELbiW0f/InQg/DtQctnQ12PRXAT5bh/WtvXOPRQlKzcA7sbW5M/vEvte3o7kdTG 7HxJY8g976SonZoTnXitvbOWTGoS+bnZQC9CeHMERQpImqLVy/2lSbykygMhRYZ+NyrSMa xDYUpHJ3PIRZBL1fsdqv2/vVNLC1b0rBtm4vI5kIBf733UlXtREOsXKcztfNYAvyVmJ36j AcfqdaG/Thl5b3kkVQOEkWWjkqX01JIclUBzSHeiu4mFBA4CyVbKQh74zJWEdRXig+8lN/ 1nppgsN48ZSrS95DKfdp/glRITMqSAh2sTmECUtg1RI4pRfUju/9TczBoIbQJg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1725483262; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=I5tL08npTbZXefjy1vUW9hi6mevY9RDV8WaLS6SsFsk=; b=mZV0flj7KcoNEyWV5YheHz/JnvlV05BDZDzz+DYBCGgDbt59OWrip51bp3EX9OnMEZFJ1+ KbVoNFKphjNnZiWL2qLDTAsKTzL5mfLQy1Ix09jAmaH9vbWckm0KF1XDUvb2UYAsnebgQk +r3k+47VyrbxnmYGVhZeeTSOQSsJ/lwfz6s8YxS1i2M22Oc1BS2TXPN5K8eJtS9J9h4CWb e3M/OjoMH+oopC8OZ9fAwWcme6p21g5tPqJUdBqV77+Z1JUB73HVWR4UBl+u1zOCTEAvEl II44qSA8dXmDvfbMG2LYzbXQl3ZurKQ1vgqYYiGWzuomnXUv6MHIFBHDRAZTRQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WzZVQ5DmkzgYy; Wed, 4 Sep 2024 20:54:22 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 484KsMG5034151; Wed, 4 Sep 2024 20:54:22 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 484KsMi8034148; Wed, 4 Sep 2024 20:54:22 GMT (envelope-from git) Date: Wed, 4 Sep 2024 20:54:22 GMT Message-Id: <202409042054.484KsMi8034148@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 6d2923e03221 - releng/14.0 - umtx: shm: Fix use-after-free due to multiple drops of the registry reference List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/releng/14.0 X-Git-Reftype: branch X-Git-Commit: 6d2923e0322179fa3d12b879f2ec8943f92d2ed6 Auto-Submitted: auto-generated The branch releng/14.0 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=6d2923e0322179fa3d12b879f2ec8943f92d2ed6 commit 6d2923e0322179fa3d12b879f2ec8943f92d2ed6 Author: Olivier Certner AuthorDate: 2024-09-04 14:38:12 +0000 Commit: Ed Maste CommitDate: 2024-09-04 20:54:03 +0000 umtx: shm: Fix use-after-free due to multiple drops of the registry reference umtx_shm_unref_reg_locked() would unconditionally drop the "registry" reference, tied to USHMF_LINKED. This is not a problem for caller umtx_shm_object_terminated(), which operates under the 'umtx_shm_lock' lock end-to-end, but it is for indirect caller umtx_shm(), which drops the lock between umtx_shm_find_reg() and the call to umtx_shm_unref_reg(true) that deregisters the umtx shared region (from 'umtx_shm_registry'; umtx_shm_find_reg() only finds registered shared mutexes). Thus, two concurrent user-space callers of _umtx_op() with UMTX_OP_SHM and flags UMTX_SHM_DESTROY, both progressing past umtx_shm_find_reg() but before umtx_shm_unref_reg(true), would then decrease twice the reference count for the single reference standing for the shared mutex's registration. Reported by: Synacktiv Reviewed by: kib Approved by: emaste (mentor) Security: FreeBSD-SA-24:14.umtx Security: CVE-2024-43102 Security: CAP-01 Sponsored by: The Alpha-Omega Project Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D46126 (cherry picked from commit 62f40433ab47ad4a9694a22a0313d57661502ca1) (cherry picked from commit be7dc4613909e528e8b4ea8aaa3ae3aa62bec1ed) Approved by: so --- sys/kern/kern_umtx.c | 51 +++++++++++++++++++++++++++++++++------------------ 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/sys/kern/kern_umtx.c b/sys/kern/kern_umtx.c index afc3f705e231..4f8d13a40d31 100644 --- a/sys/kern/kern_umtx.c +++ b/sys/kern/kern_umtx.c @@ -4362,39 +4362,49 @@ umtx_shm_free_reg(struct umtx_shm_reg *reg) } static bool -umtx_shm_unref_reg_locked(struct umtx_shm_reg *reg, bool force) +umtx_shm_unref_reg_locked(struct umtx_shm_reg *reg, bool linked_ref) { - bool res; - mtx_assert(&umtx_shm_lock, MA_OWNED); KASSERT(reg->ushm_refcnt > 0, ("ushm_reg %p refcnt 0", reg)); - reg->ushm_refcnt--; - res = reg->ushm_refcnt == 0; - if (res || force) { - if ((reg->ushm_flags & USHMF_LINKED) != 0) { - TAILQ_REMOVE(&umtx_shm_registry[reg->ushm_key.hash], - reg, ushm_reg_link); - LIST_REMOVE(reg, ushm_obj_link); - reg->ushm_flags &= ~USHMF_LINKED; - } + + if (linked_ref) { + if ((reg->ushm_flags & USHMF_LINKED) == 0) + /* + * The reference tied to USHMF_LINKED has already been + * released concurrently. + */ + return (false); + + TAILQ_REMOVE(&umtx_shm_registry[reg->ushm_key.hash], reg, + ushm_reg_link); + LIST_REMOVE(reg, ushm_obj_link); + reg->ushm_flags &= ~USHMF_LINKED; } - return (res); + + reg->ushm_refcnt--; + return (reg->ushm_refcnt == 0); } static void -umtx_shm_unref_reg(struct umtx_shm_reg *reg, bool force) +umtx_shm_unref_reg(struct umtx_shm_reg *reg, bool linked_ref) { vm_object_t object; bool dofree; - if (force) { + if (linked_ref) { + /* + * Note: This may be executed multiple times on the same + * shared-memory VM object in presence of concurrent callers + * because 'umtx_shm_lock' is not held all along in umtx_shm() + * and here. + */ object = reg->ushm_obj->shm_object; VM_OBJECT_WLOCK(object); vm_object_set_flag(object, OBJ_UMTXDEAD); VM_OBJECT_WUNLOCK(object); } mtx_lock(&umtx_shm_lock); - dofree = umtx_shm_unref_reg_locked(reg, force); + dofree = umtx_shm_unref_reg_locked(reg, linked_ref); mtx_unlock(&umtx_shm_lock); if (dofree) umtx_shm_free_reg(reg); @@ -4447,7 +4457,6 @@ umtx_shm_create_reg(struct thread *td, const struct umtx_key *key, if (!chgumtxcnt(cred->cr_ruidinfo, 1, lim_cur(td, RLIMIT_UMTXP))) return (ENOMEM); reg = uma_zalloc(umtx_shm_reg_zone, M_WAITOK | M_ZERO); - reg->ushm_refcnt = 1; bcopy(key, ®->ushm_key, sizeof(*key)); reg->ushm_obj = shm_alloc(td->td_ucred, O_RDWR, false); reg->ushm_cred = crhold(cred); @@ -4464,11 +4473,17 @@ umtx_shm_create_reg(struct thread *td, const struct umtx_key *key, *res = reg1; return (0); } - reg->ushm_refcnt++; TAILQ_INSERT_TAIL(&umtx_shm_registry[key->hash], reg, ushm_reg_link); LIST_INSERT_HEAD(USHM_OBJ_UMTX(key->info.shared.object), reg, ushm_obj_link); reg->ushm_flags = USHMF_LINKED; + /* + * This is one reference for the registry and the list of shared + * mutexes referenced by the VM object containing the lock pointer, and + * another for the caller, which it will free after use. So, one of + * these is tied to the presence of USHMF_LINKED. + */ + reg->ushm_refcnt = 2; mtx_unlock(&umtx_shm_lock); *res = reg; return (0);