| Message ID | 20230524-opp-lazy-uaf-v2-1-c26304544a47@kernkonzept.com (mailing list archive) |
|---|---|
| State | New, archived |
| Delegated to: | viresh kumar |
| Headers | show |
| Series | [v2] opp: Fix use-after-free in lazy_opp_tables after probe deferral | expand |
On 30-05-23, 17:54, Stephan Gerhold wrote: > When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns > -EPROBE_DEFER, the opp_table is freed again, to wait until all the > interconnect paths are available. > > However, if the OPP table is using required-opps then it may already > have been added to the global lazy_opp_tables list. The error path > does not remove the opp_table from the list again. > > This can cause crashes later when the provider of the required-opps > is added, since we will iterate over OPP tables that have already been > freed. E.g.: > > Unable to handle kernel NULL pointer dereference when read > CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 > PC is at _of_add_opp_table_v2 (include/linux/of.h:949 > drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 > drivers/opp/of.c:1032) -> lazy_link_required_opp_table() > > Fix this by calling _of_clear_opp_table() to remove the opp_table from > the list and clear other allocated resources. While at it, also add the > missing mutex_destroy() calls in the error path. > > Cc: stable@vger.kernel.org > Suggested-by: Viresh Kumar <viresh.kumar@linaro.org> > Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps") > Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com> > --- > Changes in v2: > - Call _of_clear_opp_table() as suggested by Viresh > - Also add missing mutex_destroy() calls in the error path > - Link to v1: https://lore.kernel.org/r/20230524-opp-lazy-uaf-v1-1-f5f95cb4b6de@kernkonzept.com > --- > This fixes the crash I ran into after adding an OPP table with > both "required-opps" and interconnect paths (opp-peak-kBps). > --- > drivers/opp/core.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/opp/core.c b/drivers/opp/core.c > index 85cbc8de407c..7046487dc6f4 100644 > --- a/drivers/opp/core.c > +++ b/drivers/opp/core.c > @@ -1358,7 +1358,10 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) > return opp_table; > > remove_opp_dev: > + _of_clear_opp_table(opp_table); > _remove_opp_dev(opp_dev, opp_table); > + mutex_destroy(&opp_table->genpd_virt_dev_lock); > + mutex_destroy(&opp_table->lock); > err: > kfree(opp_table); > return ERR_PTR(ret); > Applied. Thanks.
diff --git a/drivers/opp/core.c b/drivers/opp/core.c index 85cbc8de407c..7046487dc6f4 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -1358,7 +1358,10 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) return opp_table; remove_opp_dev: + _of_clear_opp_table(opp_table); _remove_opp_dev(opp_dev, opp_table); + mutex_destroy(&opp_table->genpd_virt_dev_lock); + mutex_destroy(&opp_table->lock); err: kfree(opp_table); return ERR_PTR(ret);
When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until all the interconnect paths are available. However, if the OPP table is using required-opps then it may already have been added to the global lazy_opp_tables list. The error path does not remove the opp_table from the list again. This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.: Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table() Fix this by calling _of_clear_opp_table() to remove the opp_table from the list and clear other allocated resources. While at it, also add the missing mutex_destroy() calls in the error path. Cc: stable@vger.kernel.org Suggested-by: Viresh Kumar <viresh.kumar@linaro.org> Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps") Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com> --- Changes in v2: - Call _of_clear_opp_table() as suggested by Viresh - Also add missing mutex_destroy() calls in the error path - Link to v1: https://lore.kernel.org/r/20230524-opp-lazy-uaf-v1-1-f5f95cb4b6de@kernkonzept.com --- This fixes the crash I ran into after adding an OPP table with both "required-opps" and interconnect paths (opp-peak-kBps). --- drivers/opp/core.c | 3 +++ 1 file changed, 3 insertions(+) --- base-commit: 9e28f7a74581204807f20ae46568939038e327aa change-id: 20230524-opp-lazy-uaf-60a004b385ec Best regards,