From patchwork Thu Jun 1 03:33:17 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?VHJldm9yIFd1ICjlkLPmlofoia8p?= X-Patchwork-Id: 101694 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp29349vqr; Wed, 31 May 2023 20:51:12 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ5QsbSTvAGJD2FMQtiMvfZJyk6DVfJH9SdTVcrn3SiOVGEFlnElrK5Bac9fAlkx3KOC7Ylw X-Received: by 2002:a9d:4f06:0:b0:6a6:5a48:1f9b with SMTP id d6-20020a9d4f06000000b006a65a481f9bmr4187450otl.8.1685591471698; Wed, 31 May 2023 20:51:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685591471; cv=none; d=google.com; s=arc-20160816; b=moSh/lzZkzzZx8wNAv3s/L137dl2kNg1XeM6sPuEinH9Pp+V/msyN6kW2O8OftIwVk DB6rbdwwTrkD48y4KIlc04b0K0GeXRUFlHpnOIgt10JQskM+EtkmqQv2xdV1lRjrcPEK jXCH4jSt6Yfgm5hXfVXFN0uF5yP+7nPKRPijzwtPyonvVc5ENUHvWzGuoQpaXb0kJ9Rb Kj7BdUoA+ZrCwoVlOxLIywbjoQhCCfOCGwC7ydRRXRYCmG4UaHU4XRF8fXV4w0subqcd CjSFKhBIjJp4VrqVKSFgtE/PBLCO4uOlWVCGGorarGspSU7pSLNmVNKR1aFLYijiUs7e Tkvw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:dkim-signature; bh=PvxE9bBd/if4KF5aIDjYjFf4UguqjqlL4OmiATrQGYg=; b=udXoZYLoFfB2H4Sqj36NgvI/tdYPgw2K3Tj2YL94jdPArv9pDSILrAACpanmxhb5T5 e+QRR5QaC7McHjwECcRyy5eQeojY/+usOk8/MDumUkyw1SU7MjgQ6g81eHKFqpyayLns gtPdkfIucUcUU0H5UglRttE4E3cTsZpLb3ibL4I5dR7mNIBS8DP8cBMKASjNyyyfriFo 6i5bl/TxAYGE7+UKYdkApM8Fml2laavfmV7Hh5PRBs7V9HTGlehx0vLaf+cdgm+crVnA l9yrTf1lMEP+vlQWIN1GRlwBG485ek9pv8wc8hck63GmjUuzgYwUeyTbLu+5SMthN9sf yKJg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@mediatek.com header.s=dk header.b=E3maQCXQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mediatek.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v22-20020a636116000000b0053f25281d15si2105654pgb.537.2023.05.31.20.50.56; Wed, 31 May 2023 20:51:11 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@mediatek.com header.s=dk header.b=E3maQCXQ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mediatek.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230496AbjFADdg (ORCPT + 99 others); Wed, 31 May 2023 23:33:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230394AbjFADdb (ORCPT ); Wed, 31 May 2023 23:33:31 -0400 Received: from mailgw02.mediatek.com (unknown [210.61.82.184]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9BE45123 for ; Wed, 31 May 2023 20:33:24 -0700 (PDT) X-UUID: 0de5c174002d11eeb20a276fd37b9834-20230601 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=PvxE9bBd/if4KF5aIDjYjFf4UguqjqlL4OmiATrQGYg=; b=E3maQCXQ3pcdmrxljXr6QL7wRUyZxt/MlcKmlDFVal3tan00PJ+34/jOob211J8DB9EUx852Lpz4qMxXwcmscAyDAggsK+qYNVTltHnHeLbPnaHC6Qcg0Rm+zSjr0uj32Z/lg+K35w1MmwxII1Uv/6IIM0xAAhtUcyrK+LCdYU4=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.25,REQID:215a5e4a-2c8a-4262-be3d-000812c5b9d6,IP:0,U RL:0,TC:0,Content:-25,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTIO N:release,TS:-25 X-CID-META: VersionHash:d5b0ae3,CLOUDID:32d5033d-de1e-4348-bc35-c96f92f1dcbb,B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:0,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-UUID: 0de5c174002d11eeb20a276fd37b9834-20230601 Received: from mtkmbs13n2.mediatek.inc [(172.21.101.108)] by mailgw02.mediatek.com (envelope-from ) (Generic MTA with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 163313893; Thu, 01 Jun 2023 11:33:20 +0800 Received: from mtkmbs11n1.mediatek.inc (172.21.101.186) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.26; Thu, 1 Jun 2023 11:33:19 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs11n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.1118.26 via Frontend Transport; Thu, 1 Jun 2023 11:33:19 +0800 From: Trevor Wu To: , , , , , CC: , , , , , Subject: [PATCH v2 1/2] ASoC: mediatek: mt8188: fix use-after-free in driver remove path Date: Thu, 1 Jun 2023 11:33:17 +0800 Message-ID: <20230601033318.10408-2-trevor.wu@mediatek.com> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20230601033318.10408-1-trevor.wu@mediatek.com> References: <20230601033318.10408-1-trevor.wu@mediatek.com> MIME-Version: 1.0 X-MTK: N X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE, UNPARSEABLE_RELAY autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767470763388525829?= X-GMAIL-MSGID: =?utf-8?q?1767470763388525829?= During mt8188_afe_init_clock(), mt8188_audsys_clk_register() was called followed by several other devm functions. The caller of mt8188_afe_init_clock() utilized devm_add_action_or_reset() to call mt8188_afe_deinit_clock(). However, the order was incorrect, causing a use-after-free issue during remove time. At probe time, the order of calls was: 1. mt8188_audsys_clk_register 2. afe_priv->clk = devm_kcalloc 3. afe_priv->clk[i] = devm_clk_get At remove time, the order of calls was: 1. mt8188_audsys_clk_unregister 3. free afe_priv->clk[i] 2. free afe_priv->clk To resolve the problem, it's necessary to move devm_add_action_or_reset() to the appropriate position so that the remove order can be 3->2->1. Fixes: f6b026479b13 ("ASoC: mediatek: mt8188: support audio clock control") Signed-off-by: Trevor Wu Reviewed-by: Douglas Anderson Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Alexandre Mergnat --- sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 7 --- sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 1 - sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4 -- sound/soc/mediatek/mt8188/mt8188-audsys-clk.c | 47 ++++++++++--------- sound/soc/mediatek/mt8188/mt8188-audsys-clk.h | 1 - 5 files changed, 24 insertions(+), 36 deletions(-) diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c index 4c24d0b9e90d..e69c1bb2cb23 100644 --- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.c +++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.c @@ -436,13 +436,6 @@ int mt8188_afe_init_clock(struct mtk_base_afe *afe) return 0; } -void mt8188_afe_deinit_clock(void *priv) -{ - struct mtk_base_afe *afe = priv; - - mt8188_audsys_clk_unregister(afe); -} - int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk) { int ret; diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h index 904505d10841..ec53c171c170 100644 --- a/sound/soc/mediatek/mt8188/mt8188-afe-clk.h +++ b/sound/soc/mediatek/mt8188/mt8188-afe-clk.h @@ -111,7 +111,6 @@ int mt8188_afe_get_default_mclk_source_by_rate(int rate); int mt8188_get_apll_by_rate(struct mtk_base_afe *afe, int rate); int mt8188_get_apll_by_name(struct mtk_base_afe *afe, const char *name); int mt8188_afe_init_clock(struct mtk_base_afe *afe); -void mt8188_afe_deinit_clock(void *priv); int mt8188_afe_enable_clk(struct mtk_base_afe *afe, struct clk *clk); void mt8188_afe_disable_clk(struct mtk_base_afe *afe, struct clk *clk); int mt8188_afe_set_clk_rate(struct mtk_base_afe *afe, struct clk *clk, diff --git a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c index c3fd32764da0..6a24b339444b 100644 --- a/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c +++ b/sound/soc/mediatek/mt8188/mt8188-afe-pcm.c @@ -3256,10 +3256,6 @@ static int mt8188_afe_pcm_dev_probe(struct platform_device *pdev) if (ret) return dev_err_probe(dev, ret, "init clock error"); - ret = devm_add_action_or_reset(dev, mt8188_afe_deinit_clock, (void *)afe); - if (ret) - return ret; - spin_lock_init(&afe_priv->afe_ctrl_lock); mutex_init(&afe->irq_alloc_lock); diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c index be1c53bf4729..c796ad8b62ee 100644 --- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c +++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.c @@ -138,6 +138,29 @@ static const struct afe_gate aud_clks[CLK_AUD_NR_CLK] = { GATE_AUD6(CLK_AUD_GASRC11, "aud_gasrc11", "top_asm_h", 11), }; +static void mt8188_audsys_clk_unregister(void *data) +{ + struct mtk_base_afe *afe = data; + struct mt8188_afe_private *afe_priv = afe->platform_priv; + struct clk *clk; + struct clk_lookup *cl; + int i; + + if (!afe_priv) + return; + + for (i = 0; i < CLK_AUD_NR_CLK; i++) { + cl = afe_priv->lookup[i]; + if (!cl) + continue; + + clk = cl->clk; + clk_unregister_gate(clk); + + clkdev_drop(cl); + } +} + int mt8188_audsys_clk_register(struct mtk_base_afe *afe) { struct mt8188_afe_private *afe_priv = afe->platform_priv; @@ -179,27 +202,5 @@ int mt8188_audsys_clk_register(struct mtk_base_afe *afe) afe_priv->lookup[i] = cl; } - return 0; -} - -void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe) -{ - struct mt8188_afe_private *afe_priv = afe->platform_priv; - struct clk *clk; - struct clk_lookup *cl; - int i; - - if (!afe_priv) - return; - - for (i = 0; i < CLK_AUD_NR_CLK; i++) { - cl = afe_priv->lookup[i]; - if (!cl) - continue; - - clk = cl->clk; - clk_unregister_gate(clk); - - clkdev_drop(cl); - } + return devm_add_action_or_reset(afe->dev, mt8188_audsys_clk_unregister, afe); } diff --git a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h index 6c5f463ad7e4..45b0948c4a06 100644 --- a/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h +++ b/sound/soc/mediatek/mt8188/mt8188-audsys-clk.h @@ -10,6 +10,5 @@ #define _MT8188_AUDSYS_CLK_H_ int mt8188_audsys_clk_register(struct mtk_base_afe *afe); -void mt8188_audsys_clk_unregister(struct mtk_base_afe *afe); #endif