linux-kernel - Re: [PATCH] thermal/of: Fix double free of params during unregistration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f559a614-93d5-121a-8ff3-0da77bc85f44@linaro.org>
Date:   Sun, 23 Jul 2023 11:57:52 +0200
From:   Daniel Lezcano <daniel.lezcano@...aro.org>
To:     Mark Brown <broonie@...nel.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Amit Kucheria <amitk@...nel.org>,
        Zhang Rui <rui.zhang@...el.com>
Cc:     Hugh Dickins <hughd@...gle.com>, Will Deacon <will@...nel.org>,
        Icenowy Zheng <uwu@...nowy.me>, Chen-Yu Tsai <wens@...e.org>,
        Jernej Skrabec <jernej.skrabec@...il.com>,
        Samuel Holland <samuel@...lland.org>,
        linux-sunxi@...ts.linux.dev, linux-pm@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH] thermal/of: Fix double free of params during
 unregistration


Hi Mark,

On 23/07/2023 01:26, Mark Brown wrote:
> Unlike the other data structures provided during registration the
> thermal core takes a copy of the thermal_zone_params provided to it and
> stores that copy in the thermal_zone_device, taking care to free it on
> unregistration.  This is done because the parameters will be modified at
> runtime.
> 
> Unfortunately the thermal_of code assumes that the params structure it
> provides will be used throughout the lifetime of the device and since
> the params are dynamically allocated based on the bindings it attempts
> to free it on unregistration.  This results in not only leaking the
> original params but also double freeing the copy the core made, leading
> to memory corruption.
> 
> Fix this by instead freeing the params parsed from the DT during
> registration.
> 
> This issue causing instability on systems where thermal zones are
> unregistered, especially visble on those systems where some zones
> provided by a device have no trip points such as Allwinner systems.
> For example with current mainline an arm64 defconfig is unbootable on
> Pine64 Plus and LibreTech Tritium is massively unstable.  These issues
> have been there for a while and have been made more prominent by recent
> memory management changes.
> 
> Fixes: 3fd6d6e2b4e80 ("thermal/of: Rework the thermal device tree initialization")
> Signed-off-by: Mark Brown <broonie@...nel.org>
> Cc: stable@...r.kernel.org

I think this issue has been fixed by:

https://lore.kernel.org/all/20230708112720.2897484-2-a.fatoum@pengutronix.de/

Rafael ? Did you pick it up ?


-- 
<http://www.linaro.org/> Linaro.org │ Open source software for ARM SoCs

Follow Linaro:  <http://www.facebook.com/pages/Linaro> Facebook |
<http://twitter.com/#!/linaroorg> Twitter |
<http://www.linaro.org/linaro-blog/> Blog