linux-kernel - [PATCH 2/3] EDAC/device: Fix potential slab-use-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231008080231.51917-2-qiuxu.zhuo@intel.com>
Date:   Sun,  8 Oct 2023 16:02:30 +0800
From:   Qiuxu Zhuo <qiuxu.zhuo@...el.com>
To:     Borislav Petkov <bp@...en8.de>, Tony Luck <tony.luck@...el.com>
Cc:     Lili Li <lili.li@...el.com>, James Morse <james.morse@....com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Robert Richter <rric@...nel.org>,
        Qiuxu Zhuo <qiuxu.zhuo@...el.com>, linux-edac@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH 2/3] EDAC/device: Fix potential slab-use-after-free

From: Lili Li <lili.li@...el.com>

If the EDAC driver invokes edac_device_alloc_ctl_info() with pvt_sz=0,
the EDAC driver itself may manage 'pvt_info' and the EDAC core shouldn't
kfree it when unloading the EDAC driver. Otherwise it may lead to a
slab-use-after-free bug. Fix the potential bug by adding a flag to indicate
whether 'pvt_info' is managed by the EDAC core. The EDAC core will only
kfree 'pvt_info' when the flag is set to true.

Fixes: 9fb9ce392aae ("EDAC/device: Get rid of the silly one-shot memory allocation in edac_device_alloc_ctl_info()")
Suggested-by: Qiuxu Zhuo <qiuxu.zhuo@...el.com>
Signed-off-by: Lili Li <lili.li@...el.com>
---
 drivers/edac/edac_device.c | 1 +
 drivers/edac/edac_device.h | 8 +++++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 0689e1510721..b990431df2eb 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -100,6 +100,7 @@ edac_device_alloc_ctl_info(unsigned pvt_sz, char *dev_name, unsigned nr_instance
 			goto free;
 
 		dev_ctl->pvt_info = pvt;
+		dev_ctl->pvt_managed_by_edac_core = true;
 	}
 
 	dev_ctl->dev_idx	= device_index;
diff --git a/drivers/edac/edac_device.h b/drivers/edac/edac_device.h
index 3f44e6b9d387..cc6a364a4b83 100644
--- a/drivers/edac/edac_device.h
+++ b/drivers/edac/edac_device.h
@@ -197,6 +197,11 @@ struct edac_device_ctl_info {
 	const char *dev_name;	/* pci/platform/etc... name */
 
 	void *pvt_info;		/* pointer to 'private driver' info */
+	/*
+	 * Indicate whether the resource pointed by pvt_info is managed by
+	 * the EDAC core.
+	 */
+	bool pvt_managed_by_edac_core;
 
 	unsigned long start_time;	/* edac_device load start time (jiffies) */
 
@@ -355,7 +360,8 @@ extern const char *edac_layer_name[];
 static inline void __edac_device_free_ctl_info(struct edac_device_ctl_info *ci)
 {
 	if (ci) {
-		kfree(ci->pvt_info);
+		if (ci->pvt_managed_by_edac_core)
+			kfree(ci->pvt_info);
 		kfree(ci->attribs);
 		kfree(ci->blocks);
 		kfree(ci->instances);
-- 
2.17.1