linux-kernel - Re: [PATCH v1 1/1] gpio: mockup: Convert to use software nodes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHp75Vf3Fb2e7efr1XpsCUB6yAPv1nT96KQ_h+hT_xUtZTksZw@mail.gmail.com>
Date:   Tue, 5 Oct 2021 12:30:51 +0300
From:   Andy Shevchenko <andy.shevchenko@...il.com>
To:     Kent Gibson <warthog618@...il.com>
Cc:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Bamvor Jian Zhang <bamv2005@...il.com>,
        Linus Walleij <linus.walleij@...aro.org>,
        Bartosz Golaszewski <brgl@...ev.pl>
Subject: Re: [PATCH v1 1/1] gpio: mockup: Convert to use software nodes

On Tue, Oct 5, 2021 at 12:28 PM Kent Gibson <warthog618@...il.com> wrote:
>
> On Tue, Oct 05, 2021 at 12:10:16PM +0300, Andy Shevchenko wrote:
> > The gpio-mockup driver creates a properties that are shared between
> > platform and GPIO devices. Because of that, the properties may not
> > be removed at the proper point of time without provoking use-after-free
> > as shown in the backtrace:
> >
> >   refcount_t: underflow; use-after-free.
> >   WARNING: CPU: 0 PID: 103 at lib/refcount.c:28 refcount_warn_saturate+0xd1/0x120
> >   ...
> >   Call Trace:
> >   kobject_put+0xdc/0xf0
> >   software_node_notify_remove+0xa8/0xc0
> >   device_del+0x15a/0x3e0
> >
> > That's why the driver has to manage lifetime of the software nodes by itself.
> >
> > The problem originates by the old device_add_properties() API, but has been
> > only revealed after the commit 5aeb05b27f81 ("software node: balance refcount
> > for managed software nodes"). Hence, it's used as landmark for the backporting.
> >
> > Fixes: 5aeb05b27f81 ("software node: balance refcount for managed software nodes")
>
> Shouldn't that be:
> Fixes: bd1e336aa853 ("driver core: platform: Remove platform_device_add_properties()")

I think you are right. I thought that it happened during the last rc-week.

> > Reported-by: Kent Gibson <warthog618@...il.com>
> > Signed-off-by: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
>
> Other than that, looks good and works for me.
>
> Tested-by: Kent Gibson <warthog618@...il.com>

Thanks!


-- 
With Best Regards,
Andy Shevchenko