linux-kernel - Re: Nokia N900: refcount_t underflow, use after free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180310112634.GA31614@amd>
Date:   Sat, 10 Mar 2018 12:26:34 +0100
From:   Pavel Machek <pavel@....cz>
To:     Suman Anna <s-anna@...com>
Cc:     Robin Murphy <robin.murphy@....com>, ivo.g.dimitrov.75@...il.com,
        khilman@...nel.org, Tony Lindgren <tony@...mide.com>,
        aaro.koskinen@....fi, kernel list <linux-kernel@...r.kernel.org>,
        sre@...nel.org, martijn@...xit.nl,
        Filip Matijević <filip.matijevic.pz@...il.com>,
        abcloriens@...il.com, sakari.ailus@...ux.intel.com,
        pali.rohar@...il.com, clayton@...ftyguy.net,
        linux-omap@...r.kernel.org, patrikbachan@...il.com,
        linux-arm-kernel <linux-arm-kernel@...ts.infradead.org>,
        serge@...lyn.com,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>
Subject: Re: Nokia N900: refcount_t underflow, use after free

Hi!

> >>> Well, there certainly seems to be an obvious bug wherein
> >>> isp_detach_iommu() just releases the mapping directly without calling
> >>> arm_iommu_detach_device() to balance the equivalent attach. That can't
> >>> be helping.
> >>
> >> Indeed, I have been able to reproduce the same warning using a
> >> standalone test module, and the missing arm_iommu_detach_device() is
> >> causing the warning after probe (during failure path) or during
> >> remove.
> > 
> > Ok do you have an idea how to fix the isp error paths? Untested patch
> > would be fine... But it seems that you know what needs to be fixed and
> > I don't.
> > 
> 
> OK, see if the following fixes the issue for you, only build tested.

Word-wrapped, so I applied by hand. And yes, the oops at boot is
gone. Thanks!

(Camera still does not work in -next... kills system. Oh well. Lets
debug that some other day.)

> 8< ---------------------
> >From bac9a48fb646dc51f2030d676a0dbe3298c3b134 Mon Sep 17 00:00:00 2001
> From: Suman Anna <s-anna@...com>
> Date: Fri, 9 Mar 2018 16:39:59 -0600
> Subject: [PATCH] media: omap3isp: fix unbalanced dma_iommu_mapping
> 
> The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware
> ARM DMA backend. The current code creates a dma_iommu_mapping and
> attaches this to the ISP device, but never detaches the mapping in
> either the probe failure paths or the driver remove path resulting
> in an unbalanced mapping refcount and a memory leak. Fix this properly.
> 
> Reported-by: Pavel Machek <pavel@....cz>
> Signed-off-by: Suman Anna <s-anna@...com>

Tested-by: Pavel Machek <pavel@....cz>
									Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)