[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMuHMdWq4d7FJp6X_3=BQU-1=xvK1_jFJuq_7mTOaBJNXr1gEQ@mail.gmail.com>
Date: Mon, 14 Aug 2023 10:41:56 +0200
From: Geert Uytterhoeven <geert@...ux-m68k.org>
To: Duoming Zhou <duoming@....edu.cn>
Cc: ysato@...rs.sourceforge.jp, dalias@...c.org,
glaubitz@...sik.fu-berlin.de, kvalo@...nel.org, pavel@....cz,
pabeni@...hat.com, rostedt@...dmis.org, linux-sh@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: Re: [PATCH] sh: push-switch: reorder cleanup operations to avoid UAF bug
On Wed, Aug 2, 2023 at 5:46 AM Duoming Zhou <duoming@....edu.cn> wrote:
> The original code puts flush_work() before timer_shutdown_sync()
> in switch_drv_remove(). Although we use flush_work() to stop
> the worker, it could be re-scheduled in switch_timer. As a result,
> the UAF bug will happen. The detail is shown below:
>
> (cpu 0) | (cpu 1)
> switch_drv_remove() |
> flush_work() |
> ... | switch_timer //timer
> | schedule_work(&psw->work)
> timer_shutdown_sync() |
> ... | switch_work_handler //worker
> kfree(psw) //free |
> | psw->state = 0 //use
>
> This patch puts timer_shutdown_sync() before flush_work() to
> mitigate the bugs. As a result, the worker and timer could
> be stopped safely before the deallocate operations.
>
> Fixes: 9f5e8eee5cfe ("sh: generic push-switch framework.")
> Signed-off-by: Duoming Zhou <duoming@....edu.cn>
Reviewed-by: Geert Uytterhoeven <geert+renesas@...der.be>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
Powered by blists - more mailing lists