Message ID | 20230413-critter-synopsis-dac070a86cb4@spud |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp1355305vqo; Thu, 13 Apr 2023 15:23:47 -0700 (PDT) X-Google-Smtp-Source: AKy350ZzpOhVeNWHuUFLuwbJEGp+oCOhyiCXiU2V/lguwvYRKrbtU6/5uH5ppMwm6t/zL824wmvq X-Received: by 2002:a17:902:c40f:b0:1a0:549d:399e with SMTP id k15-20020a170902c40f00b001a0549d399emr530802plk.21.1681424626927; Thu, 13 Apr 2023 15:23:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1681424626; cv=none; d=google.com; s=arc-20160816; b=wnjVtd6a3c4HODlhK0VwKtILbKQ8UcJOSEWiSKYKqCwlLdFQDwr1+vLxbrxmveWQzD 0OKaYORhazjgGOJHVRZkE7vO082Y3/Cx+10L1V0MEngnaCBBwFaozTp1bjOjDIShaNzf M/iO4MECf7YYcgJtUakq5e85wHptO7C88BpeCjEL1LpbQUP23hV5lFTrAh5iRd/EXC5t bRncw93AeES8REbo3l0loMvG6jTJqzKj9pv2QUDg3262dUbAzUXdMiJosOG+pqsS1Spm q+2Z/lSHw4B22uBSf7E4M1YSEJYelK333kJKSGDiqed6FBnUFR8AGiuMFiFKZ1ZpyDkt RRvA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=s7zb4HTkAescAAoIsuS5OHscKKBF/+BduGAiclEQPQE=; b=OFrioPGEP0IxgS4unh9oaPzjP+P7fEc+sgB9Lg+Cua1D5dSeD924EHjRXLm+coiaRh iTAVBa6mc/6NIUxPaY4WK7n1J9ef9uaUK/fEjowzPDtqD02S47TZ+jXiSuVtXSb0Q5rh SMj0ylFbWJoqeCydLB1k7eVNBEPKaLZo2iUCpGA+mlwY8dEQ0XyEH+swwi9vHmUqLjdT g+Tbo8+8kEcgRPbBmqE4k4BhiNvtV8qhsB+Una4ujyPPmP2d82PF4ZOaFq7k3whoUcST 52sB7czQjNW1M1vrPaLcgN8IRfSLOKt2iS6BeCuDLmvm0sUHUnLmLyv00a0y7JoD262R WnEQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dp0T5VJU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id t5-20020a170902e84500b001a66c501a46si3181667plg.136.2023.04.13.15.23.31; Thu, 13 Apr 2023 15:23:46 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=dp0T5VJU; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229899AbjDMWWA (ORCPT <rfc822;peter110.wang@gmail.com> + 99 others); Thu, 13 Apr 2023 18:22:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43172 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229853AbjDMWV4 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 13 Apr 2023 18:21:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E00A38A78; Thu, 13 Apr 2023 15:21:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7675664202; Thu, 13 Apr 2023 22:21:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C75E0C433EF; Thu, 13 Apr 2023 22:21:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1681424505; bh=LHf3EdbUfTHiiFAiofVbn0QT35RrzQGBC8v1K1+GCk8=; h=From:To:Cc:Subject:Date:From; b=dp0T5VJURoF7M0+EMhR4DY3owQX2XHIcBn191ytxWsQ3VtGxGbO45reUl1USj9c3j XGiieKLaPGOoBMaAFEp2BdJ/RXwajsp8JkwV88hNKu16Bh6cEsHbtmYtEYBVTBgAFk +jJ58cx8Ck6ykfJYC7T1N70hfOZPrf3s4S9Axlzy2++FPvnsoVRBz1cUtf/vg42PDo i/nGU1YzjqIsiqYNXePWOqecQnOoXyjHVJv8kIUBlhXASNUxrPK7LRBpKLC5nDYyZb bNAzXfVNvx2cqDpYqvaCGtuzoTPMXW8dzuyGW0y9vmq9ntuiENjvymlCiv28GezIca TsiEOgbuYa7tQ== From: Conor Dooley <conor@kernel.org> To: Stephen Boyd <sboyd@kernel.org> Cc: conor@kernel.org, Conor Dooley <conor.dooley@microchip.com>, stable@vger.kernel.org, Daire McNamara <daire.mcnamara@microchip.com>, Michael Turquette <mturquette@baylibre.com>, Claudiu Beznea <claudiu.beznea@microchip.com>, linux-clk@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v1] clk: microchip: fix potential UAF in auxdev release callback Date: Thu, 13 Apr 2023 23:20:45 +0100 Message-Id: <20230413-critter-synopsis-dac070a86cb4@spud> X-Mailer: git-send-email 2.39.2 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1803; i=conor.dooley@microchip.com; h=from:subject:message-id; bh=4o5FqEparnIFOIeeg2rKzW8byGnby2Xg9Ye2UA6HtQY=; b=owGbwMvMwCFWscWwfUFT0iXG02pJDCkWDZbXVvqGiJ3V3JfLUmQ16bfqZK+A53I7Dz7/vbXzy /ZXFtxnO0pZGMQ4GGTFFFkSb/e1SK3/47LDuectzBxWJpAhDFycAjARgxkM/4NzF4pxpEXah75X Ck/mVKi/v6D2+dU3/AYLRNJ+WmzrfMLwv1jLb+mXz38vOvs+OLLyG6/IrMc/ja8UfucT5Vpvdch rBw8A X-Developer-Key: i=conor.dooley@microchip.com; a=openpgp; fpr=F9ECA03CF54F12CD01F1655722E2C55B37CF380C Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1763101509553140475?= X-GMAIL-MSGID: =?utf-8?q?1763101509553140475?= |
Series |
[v1] clk: microchip: fix potential UAF in auxdev release callback
|
|
Commit Message
Conor Dooley
April 13, 2023, 10:20 p.m. UTC
From: Conor Dooley <conor.dooley@microchip.com> Similar to commit 1c11289b34ab ("peci: cpu: Fix use-after-free in adev_release()"), the auxiliary device is not torn down in the correct order. If auxiliary_device_add() fails, the release callback will be called twice, resulting in a UAF. Due to timing, the auxdev code in this driver "took inspiration" from the aforementioned commit, and thus its bugs too! Moving auxiliary_device_uninit() to the unregister callback instead avoids the issue. CC: stable@vger.kernel.org Fixes: b56bae2dd6fd ("clk: microchip: mpfs: add reset controller") Signed-off-by: Conor Dooley <conor.dooley@microchip.com> --- Stephen, Claudiu is on leave at the moment, and although I can push stuff to the at-91 tree etc, it's probably simpler if you just take this yourself? CC: Stephen Boyd <sboyd@kernel.org> CC: Conor Dooley <conor.dooley@microchip.com> CC: Daire McNamara <daire.mcnamara@microchip.com> CC: Michael Turquette <mturquette@baylibre.com> CC: Stephen Boyd <sboyd@kernel.org> CC: Claudiu Beznea <claudiu.beznea@microchip.com> CC: linux-clk@vger.kernel.org CC: linux-kernel@vger.kernel.org --- drivers/clk/microchip/clk-mpfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
Comments
Quoting Conor Dooley (2023-04-13 15:20:45) > From: Conor Dooley <conor.dooley@microchip.com> > > Similar to commit 1c11289b34ab ("peci: cpu: Fix use-after-free in > adev_release()"), the auxiliary device is not torn down in the correct > order. If auxiliary_device_add() fails, the release callback will be > called twice, resulting in a UAF. Due to timing, the auxdev code in this > driver "took inspiration" from the aforementioned commit, and thus its > bugs too! > > Moving auxiliary_device_uninit() to the unregister callback instead > avoids the issue. > > CC: stable@vger.kernel.org > Fixes: b56bae2dd6fd ("clk: microchip: mpfs: add reset controller") > Signed-off-by: Conor Dooley <conor.dooley@microchip.com> > --- Applied to clk-next
diff --git a/drivers/clk/microchip/clk-mpfs.c b/drivers/clk/microchip/clk-mpfs.c index 4f0a19db7ed7..cc5d7dee59f0 100644 --- a/drivers/clk/microchip/clk-mpfs.c +++ b/drivers/clk/microchip/clk-mpfs.c @@ -374,14 +374,13 @@ static void mpfs_reset_unregister_adev(void *_adev) struct auxiliary_device *adev = _adev; auxiliary_device_delete(adev); + auxiliary_device_uninit(adev); } static void mpfs_reset_adev_release(struct device *dev) { struct auxiliary_device *adev = to_auxiliary_dev(dev); - auxiliary_device_uninit(adev); - kfree(adev); }