linux-kernel - Re: [PATCH] irqchip/gic-v3: fix ppi-partitions lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171112134759.GP11226@localhost>
Date:   Sun, 12 Nov 2017 14:47:59 +0100
From:   Johan Hovold <johan@...nel.org>
To:     Marc Zyngier <marc.zyngier@....com>
Cc:     Johan Hovold <johan@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Jason Cooper <jason@...edaemon.net>,
        linux-kernel@...r.kernel.org, stable <stable@...r.kernel.org>
Subject: Re: [PATCH] irqchip/gic-v3: fix ppi-partitions lookup

On Sun, Nov 12, 2017 at 12:32:08PM +0000, Marc Zyngier wrote:
> On Sat, 11 Nov 2017 17:51:25 +0100
> Johan Hovold <johan@...nel.org> wrote:
> 
> Johan,
> 
> > Fix child-node lookup during initialisation, which ended up searching
> > the whole device tree depth-first starting at the parent rather than
> > just matching on its children.
> > 
> > To make things worse, the parent giq node was prematurely freed, while
> 
> s/giq/gic/.
> 
> Care to point out where that node would be prematurely freed? I don't
> see your patch addressing that either...

of_find_node_by_name() is used for tree-wide searches and, as
documented, drops a reference to its first argument, which in this case
is the parent gic node.

> > the ppi-partitions node was leaked.
> > 
> > Fixes: e3825ba1af3a ("irqchip/gic-v3: Add support for partitioned PPIs")
> > Cc: stable <stable@...r.kernel.org>     # 4.7
> 
> Do you have an example of this causing any trouble in the wild? As far
> as I remember, the whole of_node refcounting isn't really enforced, so
> while this is definitely a bug, it wouldn't cause any harm anywhere.

Node refcounting is enabled with CONFIG_OF_DYNAMIC (e.g. when overlay
support is enabled) and getting the refcounting wrong can lead to all
sorts of issues like use-after-free and crashes.

Using the wrong of-helper this way to lookup child nodes have been
reproduced in several drivers, and I'm trying to fix them all up (and
amend the kernel docs) to prevent this pattern from spreading further.

In general you could end up matching and parsing an unrelated node
with whatever implications that may have for a driver too.

> Or am I missing something obvious?

Feel free to drop the stable tag if you deem the implications for this
particular driver to be benign.

I can't test this one myself, but note that the node refcount is
manipulated also after the unbalanced put (e.g. in
gic_of_setup_kvm_info()).

Thanks,
Johan