linux-kernel - Re: [PATCH v2 06/14] iommu/mediatek: fix device leaks on probe()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aPXCW43vFExjkVpq@hovoldconsulting.com>
Date: Mon, 20 Oct 2025 07:02:19 +0200
From: Johan Hovold <johan@...nel.org>
To: Yong Wu (吴勇) <Yong.Wu@...iatek.com>
Cc: "joro@...tes.org" <joro@...tes.org>,
	"will@...nel.org" <will@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"j@...nau.net" <j@...nau.net>,
	"vdumpa@...dia.com" <vdumpa@...dia.com>,
	"robin.murphy@....com" <robin.murphy@....com>,
	"m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
	"wens@...e.org" <wens@...e.org>,
	"thierry.reding@...il.com" <thierry.reding@...il.com>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>,
	"iommu@...ts.linux.dev" <iommu@...ts.linux.dev>,
	"matthias.bgg@...il.com" <matthias.bgg@...il.com>,
	"robin.clark@....qualcomm.com" <robin.clark@....qualcomm.com>,
	"sven@...nel.org" <sven@...nel.org>,
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>
Subject: Re: [PATCH v2 06/14] iommu/mediatek: fix device leaks on probe()

On Sat, Oct 18, 2025 at 06:54:39AM +0000, Yong Wu (吴勇) wrote:
> On Tue, 2025-10-07 at 11:43 +0200, Johan Hovold wrote:

> > Make sure to drop the references taken to the larb devices during
> > probe on probe failure (e.g. probe deferral) and on driver unbind.
> > 
> > Note that commit 26593928564c ("iommu/mediatek: Add error path for
> > loop
> > of mm_dts_parse") fixed the leaks in a couple of error paths, but the
> > references are still leaking on success and late failures.

> > @@ -1216,13 +1216,17 @@ static int mtk_iommu_mm_dts_parse(struct
> > device *dev, struct component_match **m
> >                 platform_device_put(plarbdev);
> >         }
> > 
> > -       if (!frst_avail_smicomm_node)
> > -               return -EINVAL;
> > +       if (!frst_avail_smicomm_node) {
> > +               ret = -EINVAL;
> > +               goto err_larbdev_put;
> 
> There already is a "platform_device_put(plarbdev);" at the end of "for"
> loop, then no need put_device for it outside the "for" loop or outside
> this function?

You're right, thanks for catching that.

But this means that we have an existing potential use-after-free as if,
for example, the driver probe defers we would put the reference to any
previously looked up larbs twice.

I've just sent a v3 which fixes this by dropping the
platform_device_put() after successful lookup as it is expected that the
driver keeps the references while it uses the larb devices:

	https://lore.kernel.org/lkml/20251020045318.30690-1-johan@kernel.org/

Johan