diff mbox series

[v2] opp: Fix use-after-free in lazy_opp_tables after probe deferral

Message ID 20230524-opp-lazy-uaf-v2-1-c26304544a47@kernkonzept.com
State New
Headers
Series [v2] opp: Fix use-after-free in lazy_opp_tables after probe deferral |

Commit Message

Stephan Gerhold May 30, 2023, 3:54 p.m. UTC 
  When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns
-EPROBE_DEFER, the opp_table is freed again, to wait until all the
interconnect paths are available.

However, if the OPP table is using required-opps then it may already
have been added to the global lazy_opp_tables list. The error path
does not remove the opp_table from the list again.

This can cause crashes later when the provider of the required-opps
is added, since we will iterate over OPP tables that have already been
freed. E.g.:

  Unable to handle kernel NULL pointer dereference when read
  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3
  PC is at _of_add_opp_table_v2 (include/linux/of.h:949
  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404
  drivers/opp/of.c:1032) -> lazy_link_required_opp_table()

Fix this by calling _of_clear_opp_table() to remove the opp_table from
the list and clear other allocated resources. While at it, also add the
missing mutex_destroy() calls in the error path.

Cc: stable@vger.kernel.org
Suggested-by: Viresh Kumar <viresh.kumar@linaro.org>
Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps")
Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
---
Changes in v2:
- Call _of_clear_opp_table() as suggested by Viresh
- Also add missing mutex_destroy() calls in the error path
- Link to v1: https://lore.kernel.org/r/20230524-opp-lazy-uaf-v1-1-f5f95cb4b6de@kernkonzept.com
---
This fixes the crash I ran into after adding an OPP table with
both "required-opps" and interconnect paths (opp-peak-kBps).
---
 drivers/opp/core.c | 3 +++
 1 file changed, 3 insertions(+)


---
base-commit: 9e28f7a74581204807f20ae46568939038e327aa
change-id: 20230524-opp-lazy-uaf-60a004b385ec

Best regards,

Comments

Viresh Kumar May 31, 2023, 3:51 a.m. UTC | #1 
On 30-05-23, 17:54, Stephan Gerhold wrote:
> When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns
> -EPROBE_DEFER, the opp_table is freed again, to wait until all the
> interconnect paths are available.
> 
> However, if the OPP table is using required-opps then it may already
> have been added to the global lazy_opp_tables list. The error path
> does not remove the opp_table from the list again.
> 
> This can cause crashes later when the provider of the required-opps
> is added, since we will iterate over OPP tables that have already been
> freed. E.g.:
> 
>   Unable to handle kernel NULL pointer dereference when read
>   CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3
>   PC is at _of_add_opp_table_v2 (include/linux/of.h:949
>   drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404
>   drivers/opp/of.c:1032) -> lazy_link_required_opp_table()
> 
> Fix this by calling _of_clear_opp_table() to remove the opp_table from
> the list and clear other allocated resources. While at it, also add the
> missing mutex_destroy() calls in the error path.
> 
> Cc: stable@vger.kernel.org
> Suggested-by: Viresh Kumar <viresh.kumar@linaro.org>
> Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps")
> Signed-off-by: Stephan Gerhold <stephan.gerhold@kernkonzept.com>
> ---
> Changes in v2:
> - Call _of_clear_opp_table() as suggested by Viresh
> - Also add missing mutex_destroy() calls in the error path
> - Link to v1: https://lore.kernel.org/r/20230524-opp-lazy-uaf-v1-1-f5f95cb4b6de@kernkonzept.com
> ---
> This fixes the crash I ran into after adding an OPP table with
> both "required-opps" and interconnect paths (opp-peak-kBps).
> ---
>  drivers/opp/core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/opp/core.c b/drivers/opp/core.c
> index 85cbc8de407c..7046487dc6f4 100644
> --- a/drivers/opp/core.c
> +++ b/drivers/opp/core.c
> @@ -1358,7 +1358,10 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index)
>  	return opp_table;
>  
>  remove_opp_dev:
> +	_of_clear_opp_table(opp_table);
>  	_remove_opp_dev(opp_dev, opp_table);
> +	mutex_destroy(&opp_table->genpd_virt_dev_lock);
> +	mutex_destroy(&opp_table->lock);
>  err:
>  	kfree(opp_table);
>  	return ERR_PTR(ret);
> 

Applied. Thanks.
diff mbox series

Patch

diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 85cbc8de407c..7046487dc6f4 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -1358,7 +1358,10 @@  static struct opp_table *_allocate_opp_table(struct device *dev, int index)
 	return opp_table;
 
 remove_opp_dev:
+	_of_clear_opp_table(opp_table);
 	_remove_opp_dev(opp_dev, opp_table);
+	mutex_destroy(&opp_table->genpd_virt_dev_lock);
+	mutex_destroy(&opp_table->lock);
 err:
 	kfree(opp_table);
 	return ERR_PTR(ret);