linux-kernel - Re: [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <57ffbd01-2624-e7b4-bd27-d93cd49fbc9f@huawei.com>
Date:   Mon, 20 May 2019 17:19:49 +0800
From:   Kefeng Wang <wangkefeng.wang@...wei.com>
To:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        "Greg Kroah-Hartman" <gregkh@...uxfoundation.org>,
        Maxime Coquelin <mcoquelin.stm32@...il.com>,
        Alexandre Torgue <alexandre.torgue@...com>,
        <linux-stm32@...md-mailman.stormreply.com>,
        <linux-kernel@...r.kernel.org>
CC:     Hulk Robot <hulkci@...wei.com>
Subject: Re: [PATCH 1/2] hwtracing: stm: fix vfree() nonexistent vm_area

sorry, send wrong version,  please ignore.

On 2019/5/20 17:13, Kefeng Wang wrote:
> If device_add() in stm_register_device() fails, stm_device_release()
> is called to free stm, free stm again on err_device path will trigger
> following warning,
>
>   Trying to vfree() nonexistent vm area (0000000054b5e7bc)
>   WARNING: CPU: 0 PID: 6004 at mm/vmalloc.c:1595 __vunmap+0x72/0x480 mm/vmalloc.c:1594
>   Kernel panic - not syncing: panic_on_warn set ...
>   CPU: 0 PID: 6004 Comm: syz-executor.0 Tainted: G         C 5.1.0+ #28
>   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
>   Call Trace:
>    __vfree+0x2a/0x80 mm/vmalloc.c:1658
>    _vfree+0x49/0x70 mm/vmalloc.c:1688
>    stm_register_device+0x295/0x330 [stm_core]
>    dummy_stm_init+0xfe/0x1e0 [dummy_stm]
>    do_one_initcall+0xb9/0x3b5 init/main.c:914
>    do_init_module+0xe0/0x330 kernel/module.c:3468
>    load_module+0x38eb/0x4270 kernel/module.c:3819
>    __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
>    do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
>    entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Only free stm once if device_add() fails to fix it.
>
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Signed-off-by: Kefeng Wang <wangkefeng.wang@...wei.com>
> ---
>  drivers/hwtracing/stm/core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
> index e55b902560de..7b2ab7b2cc4d 100644
> --- a/drivers/hwtracing/stm/core.c
> +++ b/drivers/hwtracing/stm/core.c
> @@ -864,6 +864,7 @@ static void stm_device_release(struct device *dev)
>  	struct stm_device *stm = to_stm_device(dev);
>  
>  	vfree(stm);
> +	stm->data->stm = NULL;
>  }
>  
>  int stm_register_device(struct device *parent, struct stm_data *stm_data,
> @@ -933,7 +934,8 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
>  	/* matches device_initialize() above */
>  	put_device(&stm->dev);
>  err_free:
> -	vfree(stm);
> +	if (stm->data->stm)
> +		vfree(stm);
>  
>  	return err;
>  }