diff --git a/CHANGELOG.md b/CHANGELOG.md index f5d0467..08f9252 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## [2.4.4] - 2024-12-16 +- Fix the use-after-free bug of mr objects in gdrdv\_vma\_close. +- Fix the resource leakage bug in gdrdrv\_release. + ## [2.4.3] - 2024-12-02 - Fix NVIDIA\_IS\_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer. - Fix compile error in gdrdrv when compile on RHEL9.5. @@ -91,7 +95,6 @@ - Add _validate_ unit test to ensure that gdrcopy functions as expected. - Add a script for packaging gdrcopy in the rpm format. - [2.4.3]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.3 [2.4.2]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.2 [2.4.1]: https://github.com/NVIDIA/gdrcopy/releases/tag/v2.4.1 diff --git a/packages/build-deb-packages.sh b/packages/build-deb-packages.sh index aa69e5a..6fc990d 100755 --- a/packages/build-deb-packages.sh +++ b/packages/build-deb-packages.sh @@ -96,7 +96,7 @@ MODULE_SUBDIR=$(awk '/MODULE_SUBDIR \?=/ { print $3 }' ${TOP_DIR_PATH}/src/gdrdr MAJOR_VERSION=$(awk '/#define GDR_API_MAJOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n') MINOR_VERSION=$(awk '/#define GDR_API_MINOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n') -VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.3" +VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.4" if [ "X$VERSION" == "X" ]; then echo "Failed to get version numbers!" >&2 exit 1 diff --git a/packages/build-rpm-packages.sh b/packages/build-rpm-packages.sh index 42fe77a..3c9a49e 100755 --- a/packages/build-rpm-packages.sh +++ b/packages/build-rpm-packages.sh @@ -92,7 +92,7 @@ MODULE_SUBDIR=$(awk '/MODULE_SUBDIR \?=/ { print $3 }' ${TOP_DIR_PATH}/src/gdrdr MAJOR_VERSION=$(awk '/#define GDR_API_MAJOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n') MINOR_VERSION=$(awk '/#define GDR_API_MINOR_VERSION/ { print $3 }' ${TOP_DIR_PATH}/include/gdrapi.h | tr -d '\n') -VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.3" +VERSION="${MAJOR_VERSION}.${MINOR_VERSION}.4" if [ "X$VERSION" == "X" ]; then echo "Failed to get version numbers!" >&2 exit 1 diff --git a/packages/debian-lib/changelog b/packages/debian-lib/changelog index e3a3428..66e68ec 100644 --- a/packages/debian-lib/changelog +++ b/packages/debian-lib/changelog @@ -1,3 +1,9 @@ +libgdrapi (2.4.4) stable; urgency=low + + * No change. + + -- Pak Markthub Mon, 16 Dec 2024 11:59:59 -0700 + libgdrapi (2.4.3) stable; urgency=low * No change. diff --git a/packages/debian-meta/changelog b/packages/debian-meta/changelog index 6089d1d..8d26890 100644 --- a/packages/debian-meta/changelog +++ b/packages/debian-meta/changelog @@ -1,3 +1,10 @@ +gdrcopy (2.4.4) stable; urgency=low + + * Fix the use-after-free bug of mr objects in gdrdv_vma_close. + * Fix the resource leakage bug in gdrdrv_release. + + -- Pak Markthub Mon, 16 Dec 2024 11:59:59 -0700 + gdrcopy (2.4.3) stable; urgency=low * Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer. diff --git a/packages/debian-tests/changelog b/packages/debian-tests/changelog index eec4eda..f9108ad 100644 --- a/packages/debian-tests/changelog +++ b/packages/debian-tests/changelog @@ -1,3 +1,9 @@ +gdrcopy-tests (2.4.4) stable; urgency=low + + * No change. + + -- Pak Markthub Mon, 16 Dec 2024 11:59:59 -0700 + gdrcopy-tests (2.4.3) stable; urgency=low * No change. diff --git a/packages/dkms/debian/changelog b/packages/dkms/debian/changelog index af8cb72..13c8c45 100644 --- a/packages/dkms/debian/changelog +++ b/packages/dkms/debian/changelog @@ -1,3 +1,10 @@ +gdrdrv-dkms (2.4.4) stable; urgency=low + + * Fix the use-after-free bug of mr objects in gdrdv_vma_close. + * Fix the resource leakage bug in gdrdrv_release. + + -- Pak Markthub Mon, 16 Dec 2024 11:59:59 -0700 + gdrdrv-dkms (2.4.3) stable; urgency=low * Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer. diff --git a/packages/gdrcopy.spec b/packages/gdrcopy.spec index 8cf51a0..f6e9744 100644 --- a/packages/gdrcopy.spec +++ b/packages/gdrcopy.spec @@ -363,6 +363,9 @@ rm -rf $RPM_BUILD_DIR/%{name}-%{version} %changelog +* Mon Dec 16 2024 Pak Markthub 2.4.4-%{_release} +- Fix the use-after-free bug of mr objects in gdrdv_vma_close. +- Fix the resource leakage bug in gdrdrv_release. * Mon Dec 02 2024 Pak Markthub 2.4.3-%{_release} - Fix NVIDIA_IS_OPENSOURCE detection when compile with NVIDIA driver version 545 or newer. * Thu Oct 31 2024 Pak Markthub 2.4.2-%{_release} diff --git a/src/gdrdrv/gdrdrv.c b/src/gdrdrv/gdrdrv.c index 7a8b044..43017d4 100644 --- a/src/gdrdrv/gdrdrv.c +++ b/src/gdrdrv/gdrdrv.c @@ -499,6 +499,7 @@ static void gdr_free_mr_unlocked(gdr_mr_t *mr) gdr_err("nvidia_p2p_put_pages error %d, async callback may have been fired\n", status); } #endif + } else { gdr_dbg("invoking unpin_buffer while callback has already been fired\n"); @@ -527,11 +528,6 @@ static int gdrdrv_release(struct inode *inode, struct file *filp) gdr_err("filp contains no info\n"); return -EIO; } - // Check that the caller is the same process that did gdrdrv_open - if (!gdrdrv_check_same_process(info, current)) { - gdr_dbg("filp is not opened by the current process\n"); - return -EACCES; - } mutex_lock(&info->lock); list_for_each_safe(p, n, &info->mr_list) { @@ -1142,11 +1138,27 @@ static long gdrdrv_unlocked_ioctl(struct file *filp, unsigned int cmd, unsigned void gdrdrv_vma_close(struct vm_area_struct *vma) { - gdr_mr_t *mr = (gdr_mr_t *)vma->vm_private_data; - gdr_dbg("closing vma=0x%px vm_file=0x%px vm_private_data=0x%px mr=0x%px mr->vma=0x%px\n", vma, vma->vm_file, vma->vm_private_data, mr, mr->vma); + gdr_hnd_t handle; + gdr_mr_t *mr = NULL; + gdr_info_t* info = NULL; + + if (!vma->vm_file) + return; + + info = vma->vm_file->private_data; + if (!info) + return; + + handle = gdrdrv_handle_from_off(vma->vm_pgoff); + mr = gdr_get_mr_from_handle_write(info, handle); + if (!mr) + return; + + gdr_dbg("closing vma=0x%px vm_file=0x%px mr=0x%px mr->vma=0x%px\n", vma, vma->vm_file, mr, mr->vma); // TODO: handle multiple vma's mr->vma = NULL; mr->cpu_mapping_type = GDR_MR_NONE; + gdr_put_mr_write(mr); } /*----------------------------------------------------------------------------*/ @@ -1306,8 +1318,6 @@ static int gdrdrv_mmap(struct file *filp, struct vm_area_struct *vma) // Set to None first mr->cpu_mapping_type = GDR_MR_NONE; vma->vm_ops = &gdrdrv_vm_ops; - gdr_dbg("overwriting vma->vm_private_data=%px with mr=%px\n", vma->vm_private_data, mr); - vma->vm_private_data = mr; // check for physically contiguous IO ranges p = 0;