linux-kernel - Re: [PATCH] cpufreq: scmi: fix use-after-free in scmi_cpufreq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190218045330.zpiivw7mvv4hzctq@vireshk-i7>
Date:   Mon, 18 Feb 2019 10:23:30 +0530
From:   Viresh Kumar <viresh.kumar@...aro.org>
To:     Yangtao Li <tiny.windzz@...il.com>
Cc:     sudeep.holla@....com, rjw@...ysocki.net,
        linux-arm-kernel@...ts.infradead.org, linux-pm@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] cpufreq: scmi: fix use-after-free in scmi_cpufreq_exit()

On 16-02-19, 11:31, Yangtao Li wrote:
> This issue was detected with the help of Coccinelle. So
> change the order of function calls to fix it.
> 
> Fixes: 1690d8bb91e37 (cpufreq: scpi/scmi: Fix freeing of dynamic OPPs)
> 
> Signed-off-by: Yangtao Li <tiny.windzz@...il.com>
> ---
>  drivers/cpufreq/scmi-cpufreq.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
> index 242c3370544e..9ed46d188cb5 100644
> --- a/drivers/cpufreq/scmi-cpufreq.c
> +++ b/drivers/cpufreq/scmi-cpufreq.c
> @@ -187,8 +187,8 @@ static int scmi_cpufreq_exit(struct cpufreq_policy *policy)
>  
>  	cpufreq_cooling_unregister(priv->cdev);
>  	dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table);
> -	kfree(priv);
>  	dev_pm_opp_remove_all_dynamic(priv->cpu_dev);
> +	kfree(priv);
>  
>  	return 0;
>  }

Acked-by: Viresh Kumar <viresh.kumar@...aro.org>

@Rafael: Please pick it up for 5.0-rc8 as the bug was introduced
during 5.0 cycle only.

The patch it fixes had this tag:

    Cc: 4.20 <stable@...r.kernel.org> # v4.20

And so will get applied to 4.20.N, I guess we need to mark this patch
as well for stable then.

-- 
viresh