linux-kernel - Re: [PATCH v2 1/6] clk: renesas: rzv2h: Fix use-after-free in MSTOP refcount handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdV_gFP5UZ=C5SRqY0JBOi3vE1+pD+bx1taiiGoQKYRfJg@mail.gmail.com>
Date: Fri, 27 Dec 2024 15:24:32 +0100
From: Geert Uytterhoeven <geert@...ux-m68k.org>
To: Prabhakar <prabhakar.csengg@...il.com>
Cc: Michael Turquette <mturquette@...libre.com>, Stephen Boyd <sboyd@...nel.org>, 
	linux-renesas-soc@...r.kernel.org, linux-clk@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Biju Das <biju.das.jz@...renesas.com>, 
	Fabrizio Castro <fabrizio.castro.jz@...esas.com>, 
	Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>
Subject: Re: [PATCH v2 1/6] clk: renesas: rzv2h: Fix use-after-free in MSTOP
 refcount handling

On Mon, Dec 23, 2024 at 6:37 PM Prabhakar <prabhakar.csengg@...il.com> wrote:
> From: Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>
>
> Avoid triggering a `refcount_t: addition on 0; use-after-free.` warning
> when registering a module clock with the same MSTOP configuration. The
> issue arises when a module clock is registered but not enabled, resulting
> in a `ref_cnt` of 0. Subsequent calls to `refcount_inc()` on such clocks
> cause the kernel to warn about use-after-free.
>
> [ 0.113529] ------------[ cut here ]------------
> [ 0.113537] refcount_t: addition on 0; use-after-free.
> [ 0.113576] WARNING: CPU: 2 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x120/0x144
> [ 0.113602] Modules linked in:
> [ 0.113616] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.13.0-rc3+ #446
> [ 0.113629] Hardware name: Renesas RZ/V2H EVK Board based on r9a09g057h44 (DT)
> [ 0.113641] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 0.113652] pc : refcount_warn_saturate+0x120/0x144
> [ 0.113664] lr : refcount_warn_saturate+0x120/0x144
> [ 0.113675] sp : ffff8000818aba90
> [ 0.113682] x29: ffff8000818aba90 x28: ffff0000c0d96450 x27: ffff0000c0d96440
> [ 0.113699] x26: 0000000000000014 x25: 0000000000051000 x24: ffff0000c0ad6480
> [ 0.113714] x23: ffff0000c0d96200 x22: ffff800080fae558 x21: 00000000000001e0
> [ 0.113730] x20: ffff0000c0b11c10 x19: ffff8000815ae6f0 x18: 0000000000000006
> [ 0.113745] x17: ffff800081765368 x16: 0000000000000000 x15: 0765076507720766
> [ 0.113760] x14: ffff8000816a3ea0 x13: 0765076507720766 x12: 072d077207650774
> [ 0.113776] x11: ffff8000816a3ea0 x10: 00000000000000ce x9 : ffff8000816fbea0
> [ 0.113791] x8 : 0000000000017fe8 x7 : 00000000fffff000 x6 : ffff8000816fbea0
> [ 0.113806] x5 : 80000000fffff000 x4 : 0000000000000000 x3 : 0000000000000000
> [ 0.113821] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000c0158000
> [ 0.113837] Call trace:
> [ 0.113845]  refcount_warn_saturate+0x120/0x144 (P)
> [ 0.113859]  rzv2h_cpg_probe+0x7f8/0xa38
> [ 0.113874]  platform_probe+0x68/0xdc
> [ 0.113890]  really_probe+0xbc/0x2c0
> [ 0.113901]  __driver_probe_device+0x78/0x120
> [ 0.113912]  driver_probe_device+0x3c/0x154
> [ 0.113923]  __driver_attach+0x90/0x1a0
> [ 0.113933]  bus_for_each_dev+0x7c/0xe0
> [ 0.113944]  driver_attach+0x24/0x30
> [ 0.113954]  bus_add_driver+0xe4/0x208
> [ 0.113965]  driver_register+0x68/0x124
> [ 0.113975]  __platform_driver_probe+0x54/0xd4
> [ 0.113987]  rzv2h_cpg_init+0x24/0x30
> [ 0.113998]  do_one_initcall+0x60/0x1d4
> [ 0.114013]  kernel_init_freeable+0x214/0x278
> [ 0.114028]  kernel_init+0x20/0x140
> [ 0.114041]  ret_from_fork+0x10/0x20
> [ 0.114052] ---[ end trace 0000000000000000 ]---
>
> Resolve this by checking the `ref_cnt` value before calling
> `refcount_inc()`. If `ref_cnt` is 0, reset it to 1 using `refcount_set()`.
>
> Fixes: 7bd4cb3d6b7c ("clk: renesas: rzv2h: Add MSTOP support")
> Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>
> ---
> v1->v2
> - Updated commit description
> - Updated fixes tag commit header

Reviewed-by: Geert Uytterhoeven <geert+renesas@...der.be>

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds