linux-kernel - Re: [PATCH AUTOSEL 5.1 06/60] driver core: platform: Fix the usage of platform device name(pdev->name)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20190615222626.GR1513@sasha-vm>
Date:   Sat, 15 Jun 2019 18:26:27 -0400
From:   Sasha Levin <sashal@...nel.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Venkata Narendra Kumar Gutta <vnkgutta@...eaurora.org>
Subject: Re: [PATCH AUTOSEL 5.1 06/60] driver core: platform: Fix the usage
 of platform device name(pdev->name)

On Wed, Jun 05, 2019 at 06:58:46AM +0200, Greg Kroah-Hartman wrote:
>On Tue, Jun 04, 2019 at 07:21:16PM -0400, Sasha Levin wrote:
>> From: Venkata Narendra Kumar Gutta <vnkgutta@...eaurora.org>
>>
>> [ Upstream commit edb16da34b084c66763f29bee42b4e6bb33c3d66 ]
>>
>> Platform core is using pdev->name as the platform device name to do
>> the binding of the devices with the drivers. But, when the platform
>> driver overrides the platform device name with dev_set_name(),
>> the pdev->name is pointing to a location which is freed and becomes
>> an invalid parameter to do the binding match.
>>
>> use-after-free instance:
>>
>> [   33.325013] BUG: KASAN: use-after-free in strcmp+0x8c/0xb0
>> [   33.330646] Read of size 1 at addr ffffffc10beae600 by task modprobe
>> [   33.339068] CPU: 5 PID: 518 Comm: modprobe Tainted:
>> 			G S      W  O      4.19.30+ #3
>> [   33.346835] Hardware name: MTP (DT)
>> [   33.350419] Call trace:
>> [   33.352941]  dump_backtrace+0x0/0x3b8
>> [   33.356713]  show_stack+0x24/0x30
>> [   33.360119]  dump_stack+0x160/0x1d8
>> [   33.363709]  print_address_description+0x84/0x2e0
>> [   33.368549]  kasan_report+0x26c/0x2d0
>> [   33.372322]  __asan_report_load1_noabort+0x2c/0x38
>> [   33.377248]  strcmp+0x8c/0xb0
>> [   33.380306]  platform_match+0x70/0x1f8
>> [   33.384168]  __driver_attach+0x78/0x3a0
>> [   33.388111]  bus_for_each_dev+0x13c/0x1b8
>> [   33.392237]  driver_attach+0x4c/0x58
>> [   33.395910]  bus_add_driver+0x350/0x560
>> [   33.399854]  driver_register+0x23c/0x328
>> [   33.403886]  __platform_driver_register+0xd0/0xe0
>>
>> So, use dev_name(&pdev->dev), which fetches the platform device name from
>> the kobject(dev->kobj->name) of the device instead of the pdev->name.
>>
>> Signed-off-by: Venkata Narendra Kumar Gutta <vnkgutta@...eaurora.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>> Signed-off-by: Sasha Levin <sashal@...nel.org>
>> ---
>>  drivers/base/platform.c | 8 ++++----
>>  1 file changed, 4 insertions(+), 4 deletions(-)
>
>Please drop this from everywhere as it was reverted from Linus's tree
>because it causes big problems.

Dropped from all branches, thanks!

--
Thanks,
Sasha