linux-kernel - Re: [PATCH] soc: qcom: pd-mapper: Fix singleton refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <80424800-2E75-4240-9B87-FD48CC4515B0@linaro.org>
Date: Wed, 21 Aug 2024 12:26:33 +0700
From: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
To: Bjorn Andersson <quic_bjorande@...cinc.com>,
 Bjorn Andersson <andersson@...nel.org>,
 Konrad Dybcio <konrad.dybcio@...aro.org>, Chris Lew <quic_clew@...cinc.com>
CC: linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] soc: qcom: pd-mapper: Fix singleton refcount

On August 21, 2024 5:59:34 AM GMT+07:00, Bjorn Andersson <quic_bjorande@...cinc.com> wrote:
>The Qualcomm pd-mapper is a refcounted singleton, but the refcount is
>never incremented, which means the as soon as any remoteproc instance
>stops the count will hit 0.
>
>At this point the pd-mapper QMI service is stopped, leaving firmware
>without access to the PD information. Stopping any other remoteproc
>instances will result in a use-after-free, which best case manifest
>itself as a refcount underflow:
>
>  refcount_t: underflow; use-after-free.
>  WARNING: CPU: 1 PID: 354 at lib/refcount.c:87 refcount_dec_and_mutex_lock+0xc4/0x148
>  ...
>  Call trace:
>   refcount_dec_and_mutex_lock+0xc4/0x148
>   qcom_pdm_remove+0x40/0x118 [qcom_pd_mapper]
>   ...
>
>Fix this by incrementing the refcount, so that the pd-mapper is only
>torn down when the last remoteproc stops, as intended.
>
>Fixes: 1ebcde047c54 ("soc: qcom: add pd-mapper implementation")
>Signed-off-by: Bjorn Andersson <quic_bjorande@...cinc.com>
>---
> drivers/soc/qcom/qcom_pd_mapper.c | 2 ++
> 1 file changed, 2 insertions(+)

Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>




-- 
With best wishes
Dmitry