[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20230529053148.xuhuv6skg2xqworr@vireshk-i7>
Date: Mon, 29 May 2023 11:01:48 +0530
From: Viresh Kumar <viresh.kumar@...aro.org>
To: Stephan Gerhold <stephan.gerhold@...nkonzept.com>
Cc: Viresh Kumar <vireshk@...nel.org>, Nishanth Menon <nm@...com>,
Stephen Boyd <sboyd@...nel.org>, linux-pm@...r.kernel.org,
linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] opp: Fix use-after-free in lazy_opp_tables after probe
deferral
On 24-05-23, 19:56, Stephan Gerhold wrote:
> When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns
> -EPROBE_DEFER, the opp_table is freed again, to wait until all the
> interconnect paths are available.
>
> However, if the OPP table is using required-opps then it may already
> have been added to the global lazy_opp_tables list. The error path
> does not remove the opp_table from the list again.
>
> This can cause crashes later when the provider of the required-opps
> is added, since we will iterate over OPP tables that have already been
> freed. E.g.:
>
> Unable to handle kernel NULL pointer dereference when read
> CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3
> PC is at _of_add_opp_table_v2 (include/linux/of.h:949
> drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404
> drivers/opp/of.c:1032) -> lazy_link_required_opp_table()
>
> Fix this by removing the opp_table from the list before freeing it.
I think you need this instead:
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 954c94865cf5..b5973fefdfd8 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -1358,7 +1358,10 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index)
return opp_table;
remove_opp_dev:
+ _of_clear_opp_table(opp_table);
_remove_opp_dev(opp_dev, opp_table);
+ mutex_destroy(&opp_table->genpd_virt_dev_lock);
+ mutex_destroy(&opp_table->lock);
err:
kfree(opp_table);
return ERR_PTR(ret);
> Cc: stable@...r.kernel.org
> Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps")
> Signed-off-by: Stephan Gerhold <stephan.gerhold@...nkonzept.com>
> ---
> This fixes the crash I ran into after adding an OPP table with
> both "required-opps" and interconnect paths (opp-peak-kBps).
>
> By the way, the "lazy_opp_tables" does not seem to be protected by any
> locks(?)
It is always accessed with opp_table_lock held I believe.
--
viresh
Powered by blists - more mailing lists