linux-kernel - [PATCH 12/12] edac: fix kernel panic on module unloading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 14 Dec 2012 15:03:10 +0400
From:	Konstantin Khlebnikov <khlebnikov@...nvz.org>
To:	linux-kernel@...r.kernel.org
Cc:	Denis Kirjanov <kirjanov@...il.com>, Borislav Petkov <bp@...en8.de>
Subject: [PATCH 12/12] edac: fix kernel panic on module unloading

This patch fixes use-after-free and double-free bugs in edac_mc_sysfs_exit().
mci_pdev has single reference and put_device() calls mc_attr_release() which
calls kfree(), thus following device_del() works with already released memory.
An another kfree() in edac_mc_sysfs_exit() releses the same memory again. Great.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@...nvz.org>
Cc: Denis Kirjanov <kirjanov@...il.com>
Cc: Borislav Petkov <bp@...en8.de>

---

[    2.707667] general protection fault: 0000 [#1] SMP
[    2.707809] Modules linked in: sctp rfcomm bnep bluetooth fuse nfsd exportfs parport_pc parport powernow_k8 i2c_nforce2 pcspkr k8temp evbug edac_cor
e(-) kvm_amd kvm btrfs zlib_deflate libcrc32c ide_pci_generic ide_core ata_generic pata_acpi sata_nv [last unloaded: leds_pca9532]
[    2.708369] CPU 0
[    2.708369] Pid: 15179, comm: rmmod Tainted: P             3.7.0-rc8-next-20121211+ #595 Gigabyte Technology Co., Ltd. M52S-S3P/M52S-S3P
[    2.708369] RIP: 0010:[<ffffffff812e58e6>]  [<ffffffff812e58e6>] __list_add+0x26/0xd0
[    2.708369] RSP: 0018:ffff88007a609da8  EFLAGS: 00010046
[    2.708369] RAX: ffff880079883570 RBX: ffff88007a609df8 RCX: 0000000000000000
[    2.708369] RDX: ffff880079883570 RSI: 6b6b6b6b6b6b6b6b RDI: ffff88007a609df8
[    2.708369] RBP: ffff88007a609dc8 R08: 6b6b6b6b6b6b6b6b R09: 0000000000000000
[    2.708369] R10: ffff8800798934b0 R11: 0000000000000000 R12: ffff880079883570
[    2.708369] R13: 6b6b6b6b6b6b6b6b R14: 00007fc92d0d1090 R15: ffff880079883530
[    2.708369] FS:  00007fc92b533700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[    2.708369] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    2.708369] CR2: 00007f1da5d61000 CR3: 000000007b28e000 CR4: 00000000000007f0
[    2.708369] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    2.708369] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    2.708369] Process rmmod (pid: 15179, threadinfo ffff88007a608000, task ffff8800798934b0)
[    2.710227] Stack:
[    2.710227]  0000000000000000 ffff880079883538 0000000000000246 ffff8800798934b0
[    2.710227]  ffff88007a609e48 ffffffff817f711b ffffffff8141fde1 ffffffff8141e180
[    2.710227]  ffff880079883570 ffffffff812d2e3b ffff88007a609df8 ffff88007a609df8
[    2.710227] Call Trace:
[    2.710227]  [<ffffffff817f711b>] mutex_lock_nested+0xfb/0x320
[    2.710227]  [<ffffffff8141fde1>] ? device_release_driver+0x21/0x40
[    2.710227]  [<ffffffff8141e180>] ? bus_get_device_klist+0x10/0x10
[    2.710227]  [<ffffffff812d2e3b>] ? kobject_put+0x2b/0x60
[    2.710227]  [<ffffffff8141fde1>] device_release_driver+0x21/0x40
[    2.710227]  [<ffffffff8141f621>] bus_remove_device+0xf1/0x140
[    2.710227]  [<ffffffff8141cdd7>] device_del+0x127/0x1b0
[    2.710227]  [<ffffffffa0276794>] edac_mc_sysfs_exit+0x1c/0x2f [edac_core]
[    2.710227]  [<ffffffffa02767d8>] edac_exit+0x31/0x33 [edac_core]
[    2.710227]  [<ffffffff810a0ce3>] sys_delete_module+0x163/0x280
[    2.710227]  [<ffffffff812ddc34>] ? lockdep_sys_exit_thunk+0x35/0x67
[    2.710227]  [<ffffffff812ddbbe>] ? trace_hardirqs_on_thunk+0x3a/0x3f
[    2.710227]  [<ffffffff81801a12>] system_call_fastpath+0x16/0x1b
[    2.710227] Code: 00 00 00 00 00 55 48 89 e5 48 83 ec 20 48 89 5d e8 4c 89 65 f0 48 89 fb 4c 89 6d f8 4c 8b 42 08 49 89 f5 49 89 d4 49 39 f0 75 31 <4d> 8b 45 00 4d 39 c4 75 6f 4c 39 e3 74 45 4c 39 eb 74 40 49 89
[    2.710227] RIP  [<ffffffff812e58e6>] __list_add+0x26/0xd0
[    2.710227]  RSP <ffff88007a609da8>
---
 drivers/edac/edac_mc_sysfs.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index de2df92..a3b0119 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -1159,8 +1159,7 @@ int __init edac_mc_sysfs_init(void)
 
 void __exit edac_mc_sysfs_exit(void)
 {
-	put_device(mci_pdev);
 	device_del(mci_pdev);
+	put_device(mci_pdev);
 	edac_put_sysfs_subsys();
-	kfree(mci_pdev);
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/