From: Vladimir Oltean <olteanv@gmail.com>
To: Lukas Wunner <lukas@wunner.de>
Cc: Florian Fainelli <f.fainelli@gmail.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
linux-spi <linux-spi@vger.kernel.org>,
Mark Brown <broonie@kernel.org>
Subject: Re: Use after free in bcm2835_spi_remove()
Date: Wed, 14 Oct 2020 22:40:35 +0300 [thread overview]
Message-ID: <20201014194035.ukduovokggu37uba@skbuf> (raw)
In-Reply-To: <20201014140912.GB24850@wunner.de>
On Wed, Oct 14, 2020 at 04:09:12PM +0200, Lukas Wunner wrote:
> Apparently the problem is that spi_unregister_controller() drops the
> last ref on the controller, causing it to be freed, and afterwards we
> access the controller's private data, which is part of the same
> allocation as struct spi_controller:
>
> bcm2835_spi_remove()
> spi_unregister_controller()
> device_unregister()
> put_device()
> spi_controller_release() # spi_master_class.dev_release()
> kfree(ctlr)
> bcm2835_dma_release(ctlr, bs)
> ...
Also see these threads:
https://lore.kernel.org/linux-spi/20200922112241.GO4792@sirena.org.uk/T/#t
https://lore.kernel.org/linux-spi/270b94fd1e546d0c17a735c1f55500e58522da04.camel@suse.de/T/#u
And here's how _not_ to fix it:
https://lore.kernel.org/linux-spi/160088764365.36195.16185348610086043664.b4-ty@kernel.org/T/#t
At least without some care to not break other things:
https://lore.kernel.org/linux-spi/20200928080432.GC11648@pengutronix.de/T/#t
next prev parent reply other threads:[~2020-10-14 19:40 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-13 23:48 Use after free in bcm2835_spi_remove() Florian Fainelli
2020-10-14 14:09 ` Lukas Wunner
2020-10-14 19:40 ` Vladimir Oltean [this message]
2020-10-14 20:25 ` Mark Brown
2020-10-14 21:20 ` Florian Fainelli
2020-10-22 12:12 ` Lukas Wunner
2020-10-15 5:38 ` Lukas Wunner
2020-10-15 12:53 ` Mark Brown
2020-10-28 9:59 ` Lukas Wunner
2020-10-29 22:24 ` Mark Brown
2020-11-11 19:07 ` [PATCH 0/4] Use-after-free be gone Lukas Wunner
2020-11-11 19:07 ` [PATCH 1/4] spi: Introduce device-managed SPI controller allocation Lukas Wunner
2020-11-11 19:07 ` [PATCH 2/4] spi: bcm2835: Fix use-after-free on unbind Lukas Wunner
2020-11-11 20:18 ` Florian Fainelli
2020-11-11 19:07 ` [PATCH 3/4] spi: bcm2835aux: " Lukas Wunner
2020-11-11 19:07 ` [PATCH 4/4] spi: bcm-qspi: " Lukas Wunner
2020-11-11 21:12 ` Florian Fainelli
2020-11-12 13:50 ` [PATCH 0/4] Use-after-free be gone Mark Brown
2020-11-12 19:39 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201014194035.ukduovokggu37uba@skbuf \
--to=olteanv@gmail.com \
--cc=broonie@kernel.org \
--cc=f.fainelli@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-spi@vger.kernel.org \
--cc=lukas@wunner.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.