linux-kernel - Re: arm64: libgpiod: refcount_t: underflow; use-after-free.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADYN=9KCvyakA_8hN1QvSEvurfuUYoEyB1X3T9eYn3K1u2WMNQ@mail.gmail.com>
Date:   Wed, 7 Jun 2023 20:32:47 +0200
From:   Anders Roxell <anders.roxell@...aro.org>
To:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc:     Naresh Kamboju <naresh.kamboju@...aro.org>,
        Linux Media Mailing List <linux-media@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@...r.kernel.org>,
        lkft-triage@...ts.linaro.org, Bartosz Golaszewski <brgl@...ev.pl>,
        Ferry Toth <fntoth@...il.com>,
        Linus Walleij <linus.walleij@...aro.org>, warthog618@...il.com,
        Arnd Bergmann <arnd@...db.de>
Subject: Re: arm64: libgpiod: refcount_t: underflow; use-after-free.

On Tue, 21 Feb 2023 at 18:54, Andy Shevchenko
<andriy.shevchenko@...ux.intel.com> wrote:
>
> On Tue, Feb 21, 2023 at 07:13:31PM +0200, Andy Shevchenko wrote:
> > On Mon, Feb 20, 2023 at 08:29:27PM +0530, Naresh Kamboju wrote:
> > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices
> > > running Linux version v6.2.0 while running libgpiod tests.
>
> ...
>
> > -             ACPI_COMPANION_SET(&pdev->dev, NULL);
>
> This line should stay otherwise it will remove the device that may share
> the fwnode with this newly created platform device.
>

I was this issue on todays next tag: next-20230607 too, when I ran
libgpiod v1.6.4, and I
trieed to apply your proposed patch, but it didn't solve the
"refcount_t: underflow; use-after-free.".

However, understand that I shouldn't run libgpiod v1.6.4, but I did by
accident. Not sure
that I think I should get a use-after-free if I run the wrong version
of the test-suite or?

Running with libgpiod v2.0.1 I do not see this use-after-free issue.

This is how I reproduced the issue on todays next tag next-20230607, I
use tuxmake [1] to build the kernel and tuxrun [2] to run test with
the booted kernel.
$git checkout next-20230607
$ tuxmake --runtime podman --target-arch arm64 --toolchain gcc-12
--kconfig defconfig --kconfig-add
https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft-crypto.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/distro-overrides.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/systemd.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/virtio.config
--kconfig-add CONFIG_ARM64_MODULE_PLTS=y --kconfig-add
CONFIG_SYN_COOKIES=y --kconfig-add CONFIG_SCHEDSTATS=y --kconfig-add
CONFIG_GPIOLIB=y --kconfig-add CONFIG_GPIO_CDEV=y --kconfig-add
CONFIG_GPIO_MOCKUP=m --kconfig-add CONFIG_GPIO_SIM=m --results-hook
'tuxrun --runtime podman --device qemu-arm64 --boot-args rw --tuxmake
./ --rootfs https://storage.tuxboot.com/debian/bookworm/arm64/rootfs.ext4.xz
--parameters SKIPFILE=skipfile-lkft.yaml --tests libgpiod --timeouts
boot=30 --overlay
https://storage.dev.tuxboot.com/overlays/debian/bookworm/arm64/libgpiod/v1.6.4/libgpiod.tar.xz
--save-output --log-file -'

Cheers,
Anders
[1] https://tuxmake.org/
[2] https://tuxrun.org/