Skip to content

Fix a use-after-free condition of single-instance TAs#784

Open
sangho2 wants to merge 8 commits into
mainfrom
sanghle/lvbs/fix_pt_uaf
Open

Fix a use-after-free condition of single-instance TAs#784
sangho2 wants to merge 8 commits into
mainfrom
sanghle/lvbs/fix_pt_uaf

Conversation

@sangho2
Copy link
Copy Markdown
Contributor

@sangho2 sangho2 commented Apr 17, 2026

This PR fixes a use-after-free condition of single-instance TAs where a CPU core attempts to open a session with a single-instance TA with a cached instance in memory while another is tearing down it (due to session close, TA crash/panic, ...). This PR gets rid of such condition by re-checking whether a cached instance is valid or not. Also, this PR removes a fast path for single-instance TA opening which is racy with less meaningful performance benefit.

@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch from 1b2491d to 4ee95b3 Compare April 17, 2026 17:27
@sangho2 sangho2 added the must-not-merge:undergoing-restructuring Known deeper set of changes are happening on this PR before it is mergeable again label Apr 17, 2026
@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch from 4ee95b3 to 6cd446a Compare April 17, 2026 21:31
@sangho2 sangho2 removed the must-not-merge:undergoing-restructuring Known deeper set of changes are happening on this PR before it is mergeable again label Apr 17, 2026
@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch from 6cd446a to 85f20ae Compare April 17, 2026 21:41
@sangho2 sangho2 added must-not-merge:undergoing-restructuring Known deeper set of changes are happening on this PR before it is mergeable again and removed must-not-merge:undergoing-restructuring Known deeper set of changes are happening on this PR before it is mergeable again labels Apr 17, 2026
@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch 2 times, most recently from ab19e6e to 6d28883 Compare April 17, 2026 23:42
@sangho2 sangho2 marked this pull request as ready for review April 17, 2026 23:48
@sangho2 sangho2 marked this pull request as draft April 20, 2026 18:17
@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch 5 times, most recently from 13fa1bf to e755d5e Compare April 21, 2026 21:01
@sangho2 sangho2 marked this pull request as ready for review April 21, 2026 21:02
@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch from e755d5e to fae6d03 Compare May 5, 2026 22:52
Comment thread litebox_shim_optee/src/session.rs Outdated
/// should first check whether `dead == true` and if it is, bail without
/// touching `task_page_table_id`. `shim` and `loaded_program` remain
/// valid until the last `Arc` is dropped.
pub dead: bool,
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's change dead to a friendly name such as closed or unloaded or something else. Also, do we need atomic access to this field?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let me use closed or something else. This data structure is behind mutex.


// Safety: We are about to tear down this TA instance;
// no references to user-space memory will be held afterwards.
unsafe { teardown_ta_page_table(&shim, task_pt_id) };
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to mark the instance as "dead" here?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TaInstance is not yet created at this point.

@wdcui
Copy link
Copy Markdown
Member

wdcui commented May 13, 2026

I left some comments above and shared with you offline the review comments by Claude.

@sangho2 sangho2 force-pushed the sanghle/lvbs/fix_pt_uaf branch from 993b28c to 28872a2 Compare May 14, 2026 00:26
@github-actions
Copy link
Copy Markdown

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details
--- failure constructible_struct_adds_field: externally-constructible struct adds field ---

Description:
A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field.
        ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/constructible_struct_adds_field.ron

Failed in:
  field TaInstance.closed in /home/runner/work/litebox/litebox/litebox_shim_optee/src/session.rs:126
  field TaInstance.closed in /home/runner/work/litebox/litebox/litebox_shim_optee/src/session.rs:126

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/inherent_method_missing.ron

Failed in:
  SessionManager::get_single_instance, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/b61520f594d6cf604b7774f242182ab9f84652a9/litebox_shim_optee/src/session.rs:385
  SessionManager::get_single_instance, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-main/b61520f594d6cf604b7774f242182ab9f84652a9/litebox_shim_optee/src/session.rs:385

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants