Merge branch 'dev-v2.4.4' into 'R2.4'

Prepare for v2.4.4 release

See merge request gpudirect/gdrcopy!42

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## [2.4.4] - 2024-12-16
+- Fix the use-after-free bug of mr objects in gdrdv\_vma\_close.
+- Fix the resource leakage bug in gdrdrv\_release.
+
 ## [2.4.3] - 2024-12-02
 - Fix NVIDIA\_IS\_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer.
 - Fix compile error in gdrdrv when compile on RHEL9.5.
@@ -91,7 +95,6 @@
 - Add _validate_ unit test to ensure that gdrcopy functions as expected.
 - Add a script for packaging gdrcopy in the rpm format.
 
-
 [2.4.3]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.3
 [2.4.2]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.2
 [2.4.1]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.1

packages/build-deb-packages.sh

@@ -96,7 +96,7 @@ MODULE_SUBDIR=$(awk '/MODULE_SUBDIR \?=/ { print $3 }' ${TOP_DIR_PATH}/src/gdrdr
 
 MAJOR_VERSION=$(awk '/#define GDR_API_MAJOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n')
 MINOR_VERSION=$(awk '/#define GDR_API_MINOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n')
-VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.3"
+VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.4"
 if [ "X$VERSION" == "X" ]; then
     echo "Failed to get version numbers!" >&2
     exit 1

packages/build-rpm-packages.sh

@@ -92,7 +92,7 @@ MODULE_SUBDIR=$(awk '/MODULE_SUBDIR \?=/ { print $3 }' ${TOP_DIR_PATH}/src/gdrdr
 
 MAJOR_VERSION=$(awk '/#define GDR_API_MAJOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n')
 MINOR_VERSION=$(awk '/#define GDR_API_MINOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n')
-VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.3"
+VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.4"
 if [ "X$VERSION" == "X" ]; then
     echo "Failed to get version numbers!" >&2
     exit 1

packages/debian-lib/changelog

@@ -1,3 +1,9 @@
+libgdrapi (2.4.4) stable; urgency=low
+
+  * No change.
+
+ -- Pak Markthub <[email protected]>  Mon, 16 Dec 2024 11:59:59 -0700
+
 libgdrapi (2.4.3) stable; urgency=low
 
   * No change.

packages/debian-meta/changelog

@@ -1,3 +1,10 @@
+gdrcopy (2.4.4) stable; urgency=low
+
+  * Fix the use-after-free bug of mr objects in gdrdv_vma_close.
+  * Fix the resource leakage bug in gdrdrv_release.
+
+ -- Pak Markthub <[email protected]>  Mon, 16 Dec 2024 11:59:59 -0700
+
 gdrcopy (2.4.3) stable; urgency=low
 
   * Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer.

packages/debian-tests/changelog

@@ -1,3 +1,9 @@
+gdrcopy-tests (2.4.4) stable; urgency=low
+
+  * No change.
+
+ -- Pak Markthub <[email protected]>  Mon, 16 Dec 2024 11:59:59 -0700
+
 gdrcopy-tests (2.4.3) stable; urgency=low
 
   * No change.

packages/dkms/debian/changelog

@@ -1,3 +1,10 @@
+gdrdrv-dkms (2.4.4) stable; urgency=low
+
+  * Fix the use-after-free bug of mr objects in gdrdv_vma_close.
+  * Fix the resource leakage bug in gdrdrv_release.
+
+ -- Pak Markthub <[email protected]>  Mon, 16 Dec 2024 11:59:59 -0700
+
 gdrdrv-dkms (2.4.3) stable; urgency=low
 
   * Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer.

packages/gdrcopy.spec

@@ -363,6 +363,9 @@ rm -rf $RPM_BUILD_DIR/%{name}-%{version}
 
 
 %changelog
+* Mon Dec 16 2024 Pak Markthub <[email protected]> 2.4.4-%{_release}
+- Fix the use-after-free bug of mr objects in gdrdv_vma_close.
+- Fix the resource leakage bug in gdrdrv_release.
 * Mon Dec 02 2024 Pak Markthub <[email protected]> 2.4.3-%{_release}
 - Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer.
 * Thu Oct 31 2024 Pak Markthub <[email protected]> 2.4.2-%{_release}

src/gdrdrv/gdrdrv.c

@@ -499,6 +499,7 @@ static void gdr_free_mr_unlocked(gdr_mr_t *mr)
             gdr_err("nvidia_p2p_put_pages error %d, async callback may have been fired\n", status);
         }
         #endif
+
     } else {
         gdr_dbg("invoking unpin_buffer while callback has already been fired\n");
 
@@ -527,11 +528,6 @@ static int gdrdrv_release(struct inode *inode, struct file *filp)
         gdr_err("filp contains no info\n");
         return -EIO;
     }
-    // Check that the caller is the same process that did gdrdrv_open
-    if (!gdrdrv_check_same_process(info, current)) {
-        gdr_dbg("filp is not opened by the current process\n");
-        return -EACCES;
-    }
 
     mutex_lock(&info->lock);
     list_for_each_safe(p, n, &info->mr_list) {
@@ -1142,11 +1138,27 @@ static long gdrdrv_unlocked_ioctl(struct file *filp, unsigned int cmd, unsigned
 
 void gdrdrv_vma_close(struct vm_area_struct *vma)
 {
-    gdr_mr_t *mr = (gdr_mr_t *)vma->vm_private_data;
-    gdr_dbg("closing vma=0x%px vm_file=0x%px vm_private_data=0x%px mr=0x%px mr->vma=0x%px\n", vma, vma->vm_file, vma->vm_private_data, mr, mr->vma);
+    gdr_hnd_t handle;
+    gdr_mr_t *mr = NULL;
+    gdr_info_t* info = NULL;
+
+    if (!vma->vm_file)
+        return;
+
+    info = vma->vm_file->private_data;
+    if (!info)
+        return;
+
+    handle = gdrdrv_handle_from_off(vma->vm_pgoff);
+    mr = gdr_get_mr_from_handle_write(info, handle);
+    if (!mr)
+        return;
+
+    gdr_dbg("closing vma=0x%px vm_file=0x%px mr=0x%px mr->vma=0x%px\n", vma, vma->vm_file, mr, mr->vma);
     // TODO: handle multiple vma's
     mr->vma = NULL;
     mr->cpu_mapping_type = GDR_MR_NONE;
+    gdr_put_mr_write(mr);
 }
 
 /*----------------------------------------------------------------------------*/
@@ -1306,8 +1318,6 @@ static int gdrdrv_mmap(struct file *filp, struct vm_area_struct *vma)
     // Set to None first
     mr->cpu_mapping_type = GDR_MR_NONE;
     vma->vm_ops = &gdrdrv_vm_ops;
-    gdr_dbg("overwriting vma->vm_private_data=%px with mr=%px\n", vma->vm_private_data, mr);
-    vma->vm_private_data = mr;
 
     // check for physically contiguous IO ranges
     p = 0;