[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAC=S1nhT8b8aWAA=eDq_6kEjS3fWTMBTAjV2BGc2CNtGy_rD0Q@mail.gmail.com>
Date: Mon, 21 Aug 2023 14:18:53 +0800
From: Fei Shao <fshao@...omium.org>
To: Chen-Yu Tsai <wenst@...omium.org>
Cc: Yu-Che Cheng <giver@...omium.org>, Stephen Boyd <sboyd@...nel.org>,
James Lo <james.lo@...iatek.com>,
Matthias Brugger <matthias.bgg@...il.com>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@...labora.com>,
linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
linux-mediatek@...ts.infradead.org
Subject: Re: [PATCH] spmi: mediatek: Fix UAF on device remove
On Mon, Aug 21, 2023 at 11:35 AM Chen-Yu Tsai <wenst@...omium.org> wrote:
>
> On Mon, Jul 17, 2023 at 05:39:35PM +0800, Yu-Che Cheng wrote:
> > The pmif driver data that contains the clocks is allocated along with
> > spmi_controller.
> > On device remove, spmi_controller will be freed first, and then devres
> > , including the clocks, will be cleanup.
> > This leads to UAF because putting the clocks will access the clocks in
> > the pmif driver data, which is already freed along with spmi_controller.
> >
> > This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and
> > building the kernel with KASAN.
> >
> > Fix the UAF issue by using unmanaged clk_bulk_get() and putting the
> > clocks before freeing spmi_controller.
> >
> > Reported-by: Fei Shao <fshao@...omium.org>
> > Signed-off-by: Yu-Che Cheng <giver@...omium.org>
>
> Reviewed-by: Chen-Yu Tsai <wenst@...omium.org>
>
> Stephen, could you pick this up?
>
> > ---
> >
> > drivers/spmi/spmi-mtk-pmif.c | 7 +++++--
> > 1 file changed, 5 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/spmi/spmi-mtk-pmif.c b/drivers/spmi/spmi-mtk-pmif.c
> > index b3c991e1ea40..74b73f9bc222 100644
> > --- a/drivers/spmi/spmi-mtk-pmif.c
> > +++ b/drivers/spmi/spmi-mtk-pmif.c
> > @@ -465,7 +465,7 @@ static int mtk_spmi_probe(struct platform_device *pdev)
> > for (i = 0; i < arb->nclks; i++)
> > arb->clks[i].id = pmif_clock_names[i];
> >
> > - err = devm_clk_bulk_get(&pdev->dev, arb->nclks, arb->clks);
> > + err = clk_bulk_get(&pdev->dev, arb->nclks, arb->clks);
> > if (err) {
> > dev_err(&pdev->dev, "Failed to get clocks: %d\n", err);
> > goto err_put_ctrl;
> > @@ -474,7 +474,7 @@ static int mtk_spmi_probe(struct platform_device *pdev)
> > err = clk_bulk_prepare_enable(arb->nclks, arb->clks);
> > if (err) {
> > dev_err(&pdev->dev, "Failed to enable clocks: %d\n", err);
> > - goto err_put_ctrl;
> > + goto err_put_clks;
> > }
> >
> > ctrl->cmd = pmif_arb_cmd;
> > @@ -498,6 +498,8 @@ static int mtk_spmi_probe(struct platform_device *pdev)
> >
> > err_domain_remove:
> > clk_bulk_disable_unprepare(arb->nclks, arb->clks);
> > +err_put_clks:
> > + clk_bulk_put(arb->nclks, arb->clks);
> > err_put_ctrl:
> > spmi_controller_put(ctrl);
> > return err;
> > @@ -509,6 +511,7 @@ static void mtk_spmi_remove(struct platform_device *pdev)
> > struct pmif *arb = spmi_controller_get_drvdata(ctrl);
> >
> > clk_bulk_disable_unprepare(arb->nclks, arb->clks);
> > + clk_bulk_put(arb->nclks, arb->clks);
> > spmi_controller_remove(ctrl);
> > spmi_controller_put(ctrl);
>
> Maybe we need devres versions of spmi_controller_alloc and
> spmi_controller_add to avoid this in the future? I'm sure
> drivers put all sorts of stuff in their private data.
Sounds good, I think I can send a follow-up series for that.
Regards,
Fei
>
> ChenYu
>
> > }
> > --
> > 2.41.0.255.g8b1d071c50-goog
> >
Powered by blists - more mailing lists