Commit b35a1303 authored by Chia-Lin Kao (AceLan)'s avatar Chia-Lin Kao (AceLan) Committed by Keith Busch
Browse files

nvme-pci: fix use-after-free in nvme_free_host_mem() 



nvme_free_host_mem() frees dev->hmb_sgt via dma_free_noncontiguous()
but never clears the pointer afterward.  This leads to a use-after-free
if nvme_free_host_mem() is called twice in the same error path.

This can happen during nvme_probe() when nvme_setup_host_mem() succeeds
in allocating the HMB (setting dev->hmb_sgt) but nvme_set_host_mem()
fails with an I/O error:

  nvme_setup_host_mem()
    nvme_alloc_host_mem_single()   -> sets dev->hmb_sgt
    nvme_set_host_mem()            -> fails with -EIO
    nvme_free_host_mem()           -> frees hmb_sgt, but does NOT NULL it
    return error

  nvme_probe() error path:
    nvme_free_host_mem()           -> dev->hmb_sgt is stale, use-after-free

The second call dereferences the freed sgt, causing a NULL pointer
dereference in iommu_dma_free_noncontiguous() when it accesses
sgt->sgl->dma_address (the backing memory has been freed and zeroed).

This is reproducible on Thunderbolt-attached NVMe devices (e.g., OWC
Envoy Express behind a Dell WD22TB4 dock) where the device intermittently
returns I/O errors during HMB setup due to PCIe link instability.

 BUG: kernel NULL pointer dereference, address: 0000000000000010
 RIP: 0010:iommu_dma_free_noncontiguous+0x22/0x80
 Call Trace:
  <TASK>
  dma_free_noncontiguous+0x3b/0x130
  nvme_free_host_mem+0x30/0xf0 [nvme]
  nvme_probe.cold+0xcc/0x275 [nvme]
  local_pci_probe+0x43/0xa0
  pci_device_probe+0xeea/0x290
  really_probe+0xf9/0x3b0
  __driver_probe_device+0x8b/0x170
  driver_probe_device+0x24/0xd0
  __driver_attach_async_helper+0x6b/0x110
  async_run_entry_fn+0x37/0x170
  process_one_work+0x1ac/0x3d0
  worker_thread+0x1b8/0x360
  kthread+0xf7/0x130
  ret_from_fork+0x2d8/0x3a0
  ret_from_fork_asm+0x1a/0x30
  </TASK>

Fix this by setting dev->hmb_sgt to NULL after freeing it, so the
second call takes the multi-descriptor path which safely handles the
already-cleaned-up state.

Fixes: 63a5c7a4 ("nvme-pci: use dma_alloc_noncontigous if possible")
Signed-off-by: default avatarChia-Lin Kao (AceLan) <acelan.kao@canonical.com>
Signed-off-by: default avatarKeith Busch <kbusch@kernel.org>
parent a891962a

drivers/nvme/host/pci.c

+4 −2
Original line number Diff line number Diff line
@@ -2533,11 +2533,13 @@ static void nvme_free_host_mem_multi(struct nvme_dev *dev) 


static void nvme_free_host_mem(struct nvme_dev *dev)

{

	if (dev->hmb_sgt)

	if (dev->hmb_sgt) {

		dma_free_noncontiguous(dev->dev, dev->host_mem_size,

				dev->hmb_sgt, DMA_BIDIRECTIONAL);

	else

		dev->hmb_sgt = NULL;

	} else {

		nvme_free_host_mem_multi(dev);

	}



	dma_free_coherent(dev->dev, dev->host_mem_descs_size,

			dev->host_mem_descs, dev->host_mem_descs_dma);