| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241016-fix-arm-scmi-slab-use-after-free-v2-1-1783685ef90d@quicinc.com>
Date: Wed, 16 Oct 2024 14:13:38 +0800
From: Xinqi Zhang <quic_xinqzhan@...cinc.com>
To: Sudeep Holla <sudeep.holla@....com>,
Cristian Marussi
<cristian.marussi@....com>
CC: <linux-arm-msm@...r.kernel.org>, <arm-scmi@...r.kernel.org>,
<linux-arm-kernel@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
"Xinqi Zhang" <quic_xinqzhan@...cinc.com>
Subject: [PATCH v2] firmware: arm_scmi: fix slab-use-after-free in
scmi_bus_notifier()
The scmi_dev->name is released prematurely in __scmi_device_destroy(),
which causes slab-use-after-free when accessing scmi_dev->name in
scmi_bus_notifier(). So move the release of scmi_dev->name to
scmi_device_release() to avoid slab-use-after-free.
==================================================================
BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
Call trace:
dump_backtrace+0x94/0x114
show_stack+0x18/0x24
dump_stack_lvl+0x48/0x60
print_report+0xf4/0x5b0
kasan_report+0xa4/0xec
__asan_report_load1_noabort+0x20/0x2c
strncmp+0xe4/0xec
scmi_bus_notifier+0x5c/0x54c
notifier_call_chain+0xb4/0x31c
blocking_notifier_call_chain+0x68/0x9c
bus_notify+0x54/0x78
device_del+0x1bc/0x840
device_unregister+0x20/0xb4
__scmi_device_destroy+0xac/0x280
scmi_device_destroy+0x94/0xd0
scmi_chan_setup+0x524/0x750
scmi_probe+0x7fc/0x1508
platform_probe+0xc4/0x19c
really_probe+0x32c/0x99c
__driver_probe_device+0x15c/0x3c4
driver_probe_device+0x5c/0x170
__driver_attach+0x1c8/0x440
bus_for_each_dev+0xf4/0x178
driver_attach+0x3c/0x58
bus_add_driver+0x234/0x4d4
driver_register+0xf4/0x3c0
__platform_driver_register+0x60/0x88
scmi_driver_init+0xb0/0x104
do_one_initcall+0xb4/0x664
kernel_init_freeable+0x3c8/0x894
kernel_init+0x24/0x1e8
ret_from_fork+0x10/0x20
Allocated by task 1:
kasan_save_stack+0x2c/0x54
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xa0/0xb8
__kmalloc_node_track_caller+0x6c/0x104
kstrdup+0x48/0x84
kstrdup_const+0x34/0x40
__scmi_device_create.part.0+0x8c/0x408
scmi_device_create+0x104/0x370
scmi_chan_setup+0x2a0/0x750
scmi_probe+0x7fc/0x1508
platform_probe+0xc4/0x19c
really_probe+0x32c/0x99c
__driver_probe_device+0x15c/0x3c4
driver_probe_device+0x5c/0x170
__driver_attach+0x1c8/0x440
bus_for_each_dev+0xf4/0x178
driver_attach+0x3c/0x58
bus_add_driver+0x234/0x4d4
driver_register+0xf4/0x3c0
__platform_driver_register+0x60/0x88
scmi_driver_init+0xb0/0x104
do_one_initcall+0xb4/0x664
kernel_init_freeable+0x3c8/0x894
kernel_init+0x24/0x1e8
ret_from_fork+0x10/0x20
Freed by task 1:
kasan_save_stack+0x2c/0x54
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
__kasan_slab_free+0xe8/0x164
__kmem_cache_free+0x11c/0x230
kfree+0x70/0x130
kfree_const+0x20/0x40
__scmi_device_destroy+0x70/0x280
scmi_device_destroy+0x94/0xd0
scmi_chan_setup+0x524/0x750
scmi_probe+0x7fc/0x1508
platform_probe+0xc4/0x19c
really_probe+0x32c/0x99c
__driver_probe_device+0x15c/0x3c4
driver_probe_device+0x5c/0x170
__driver_attach+0x1c8/0x440
bus_for_each_dev+0xf4/0x178
driver_attach+0x3c/0x58
bus_add_driver+0x234/0x4d4
driver_register+0xf4/0x3c0
__platform_driver_register+0x60/0x88
scmi_driver_init+0xb0/0x104
do_one_initcall+0xb4/0x664
kernel_init_freeable+0x3c8/0x894
kernel_init+0x24/0x1e8
ret_from_fork+0x10/0x20
Fixes: ee7a9c9f67c5 ("firmware: arm_scmi: Add support for multiple device per protocol")
Signed-off-by: Xinqi Zhang <quic_xinqzhan@...cinc.com>
---
Changes in v2:
- Standardize commit messages and add Fixes tags.
- Link to v1: https://lore.kernel.org/r/20241015-fix-arm-scmi-slab-use-after-free-v1-1-b006eba9c8df@quicinc.com
---
drivers/firmware/arm_scmi/bus.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 96b2e5f9a8ef0386525f9d91d2925e7e6d48ac28..157172a5f2b577ce4f04425f967f548230c1ebed 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -325,7 +325,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
static void scmi_device_release(struct device *dev)
{
- kfree(to_scmi_dev(dev));
+ struct scmi_device *scmi_dev = to_scmi_dev(dev);
+
+ kfree_const(scmi_dev->name);
+ kfree(scmi_dev);
}
static void __scmi_device_destroy(struct scmi_device *scmi_dev)
@@ -338,7 +341,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
atomic_set(&scmi_syspower_registered, 0);
- kfree_const(scmi_dev->name);
ida_free(&scmi_bus_id, scmi_dev->id);
device_unregister(&scmi_dev->dev);
}
@@ -410,7 +412,6 @@ __scmi_device_create(struct device_node *np, struct device *parent,
return scmi_dev;
put_dev:
- kfree_const(scmi_dev->name);
put_device(&scmi_dev->dev);
ida_free(&scmi_bus_id, id);
return NULL;
---
base-commit: eca631b8fe808748d7585059c4307005ca5c5820
change-id: 20241015-fix-arm-scmi-slab-use-after-free-74e358b3c90c
Best regards,
--
Xinqi Zhang <quic_xinqzhan@...cinc.com>
Powered by blists - more mailing lists