Message ID | 20221116074116.1022139-1-yangyingliang@huawei.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp11530wru; Tue, 15 Nov 2022 23:54:24 -0800 (PST) X-Google-Smtp-Source: AA0mqf6HNvsLPntVuJu/JMASS92o1XBDBCV84lXf26f3kj0XF0UbaGwr9dAIvWIi8z6OucER0BC6 X-Received: by 2002:a63:4509:0:b0:46f:b6df:3107 with SMTP id s9-20020a634509000000b0046fb6df3107mr19621709pga.454.1668585264505; Tue, 15 Nov 2022 23:54:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1668585264; cv=none; d=google.com; s=arc-20160816; b=CWDkgQoHk8EkrYrvSrPXufpXMGG9QqDnmwMfiohWFZjosVJ4ofeWAwk4Tn2NMHjuHM U0KlfpCdgrt6327Z5+Ca002k8Cvg9ocTWTL3T73watT88suUvkPcq4nywvjTZVKsnx/g N7cXOPqiChmx1K57abyYxBfcoKqew215VO5LZc+dEuzboqOCQ1bgWWrnILradc6Rlyka 68L09sewqV2Z4D/X0n4+QX+C4uYpCqZFv/pufq/Aioz09USuUkC0/j4t7Yf+Upu6aOnF VYxrnRDAsoVYMbKDWwqy4cR36gFAKK/rEe9OUd3adKPYQWbCbFHWaFb6RZ2Y/X5gLBoZ sUOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=/tYV05NTc5+YRJiZrtU+5FhJhXs4HRsahaL7yaaDeDw=; b=rC26tmq5bs23FViWpNuRy+iScqH1lr7BIxlNLGtb7gq+P1enyDtY4dA0pK08Tf7UtO sIH0JeEC3icvG2NXwCoksrqGA44uBMHjzAviWgH/GmAebscgSpwhbt2meb+iZeQih/8l 20SLpq49f49jCbZ6/YWHYakJ0NhqByDsa0YjcU7Kv6LsI2iqLZJe/8K9Wh2C1ka1j0Y6 ZBnR8DFeOlGoPd5+T1WNFtzUMyMPekhiVGTmbhId/VxArwoxtC38MRqXIgHybsYoyZ4d S7b99cmEZOAHPjMMxlXvaMR8kBRP1mqRdivkEdNRnrwtF2TabSVDLvImCgD6zK/fhR2G GTew== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y21-20020a056a00191500b00571fc323489si9196226pfi.361.2022.11.15.23.54.10; Tue, 15 Nov 2022 23:54:24 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232117AbiKPHmy (ORCPT <rfc822;maxim.cournoyer@gmail.com> + 99 others); Wed, 16 Nov 2022 02:42:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229456AbiKPHmv (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Wed, 16 Nov 2022 02:42:51 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A205CE1C for <linux-kernel@vger.kernel.org>; Tue, 15 Nov 2022 23:42:50 -0800 (PST) Received: from dggpemm500021.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4NBw4B1y9xzHw02; Wed, 16 Nov 2022 15:42:18 +0800 (CST) Received: from dggpemm500007.china.huawei.com (7.185.36.183) by dggpemm500021.china.huawei.com (7.185.36.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Wed, 16 Nov 2022 15:42:48 +0800 Received: from huawei.com (10.175.103.91) by dggpemm500007.china.huawei.com (7.185.36.183) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.31; Wed, 16 Nov 2022 15:42:48 +0800 From: Yang Yingliang <yangyingliang@huawei.com> To: <linux-kernel@vger.kernel.org> CC: <lee@kernel.org>, <krzysztof.kozlowski@canonical.com> Subject: [PATCH] mfd: core: fix UAF while using device of node Date: Wed, 16 Nov 2022 15:41:16 +0800 Message-ID: <20221116074116.1022139-1-yangyingliang@huawei.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.103.91] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To dggpemm500007.china.huawei.com (7.185.36.183) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1749638462282943885?= X-GMAIL-MSGID: =?utf-8?q?1749638462282943885?= |
Series |
mfd: core: fix UAF while using device of node
|
|
Commit Message
Yang Yingliang
Nov. 16, 2022, 7:41 a.m. UTC
I got the following UAF report:
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 270 at lib/refcount.c:29 refcount_warn_saturate+0x121/0x180
...
OF: ERROR: memory leak, expected refcount 1 instead of -1073741824,
of_node_get()/of_node_put() unbalanced - destroy cset entry:
attach overlay node /i2c/pmic@62/powerkey
The of_node of device assigned in mfd_match_of_node_to_dev() need be
get, and it will be put in platform_device_release().
Fixes: 002be8114007 ("mfd: core: Add missing of_node_put for loop iteration")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
---
drivers/mfd/mfd-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
Comments
Hi, On 2022/11/16 15:41, Yang Yingliang wrote: > I got the following UAF report: > > refcount_t: underflow; use-after-free. > WARNING: CPU: 1 PID: 270 at lib/refcount.c:29 refcount_warn_saturate+0x121/0x180 > ... > OF: ERROR: memory leak, expected refcount 1 instead of -1073741824, > of_node_get()/of_node_put() unbalanced - destroy cset entry: > attach overlay node /i2c/pmic@62/powerkey > > The of_node of device assigned in mfd_match_of_node_to_dev() need be > get, and it will be put in platform_device_release(). > > Fixes: 002be8114007 ("mfd: core: Add missing of_node_put for loop iteration") > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Is this patch good or do you have any suggestion ? Thanks, Yang > --- > drivers/mfd/mfd-core.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c > index 16d1861e9682..8e57f67719cf 100644 > --- a/drivers/mfd/mfd-core.c > +++ b/drivers/mfd/mfd-core.c > @@ -161,7 +161,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev, > of_entry->np = np; > list_add_tail(&of_entry->list, &mfd_of_node_list); > > - pdev->dev.of_node = np; > + pdev->dev.of_node = of_node_get(np); > pdev->dev.fwnode = &np->fwnode; > #endif > return 0;
On Thu, 08 Dec 2022, Yang Yingliang wrote: > Hi, > > On 2022/11/16 15:41, Yang Yingliang wrote: > > I got the following UAF report: > > > > refcount_t: underflow; use-after-free. > > WARNING: CPU: 1 PID: 270 at lib/refcount.c:29 refcount_warn_saturate+0x121/0x180 > > ... > > OF: ERROR: memory leak, expected refcount 1 instead of -1073741824, > > of_node_get()/of_node_put() unbalanced - destroy cset entry: > > attach overlay node /i2c/pmic@62/powerkey > > > > The of_node of device assigned in mfd_match_of_node_to_dev() need be > > get, and it will be put in platform_device_release(). > > > > Fixes: 002be8114007 ("mfd: core: Add missing of_node_put for loop iteration") > > Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> > Is this patch good or do you have any suggestion ? Looks okay, but I'm not applying it this late in the cycle. Please wait until the next merge-window closes.
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c index 16d1861e9682..8e57f67719cf 100644 --- a/drivers/mfd/mfd-core.c +++ b/drivers/mfd/mfd-core.c @@ -161,7 +161,7 @@ static int mfd_match_of_node_to_dev(struct platform_device *pdev, of_entry->np = np; list_add_tail(&of_entry->list, &mfd_of_node_list); - pdev->dev.of_node = np; + pdev->dev.of_node = of_node_get(np); pdev->dev.fwnode = &np->fwnode; #endif return 0;