From: Priya Bala Govindasamy <pgovind2@uci.edu>
To: gregkh@linuxfoundation.org, rafael@kernel.org, dakr@kernel.org,
ojeda@kernel.org
Cc: boqun@kernel.org, gary@garyguo.net, bjorn3_gh@protonmail.com,
lossin@kernel.org, a.hindborg@kernel.org, aliceryhl@google.com,
tmgross@umich.edu, daniel.almeida@collabora.com,
tamird@kernel.org, acourbot@nvidia.com, work@onurozkan.dev,
mmaurer@google.com, driver-core@lists.linux.dev,
rust-for-linux@vger.kernel.org, ardalan@uci.edu,
zhiyunq@cs.ucr.edu, dzueck@uci.edu, pgovind2@uci.edu
Subject: [PATCH 0/1] rust: soc: avoid dangling attributes when SoC bus is unavailable
Date: Tue, 27 Oct 2026 17:48:09 +0000 [thread overview]
Message-ID: <cover.1792628232.git.pgovind2@uci.edu> (raw)
Dear Linux kernel maintainers,
We are developing a tool called FerroLens to detect potential
unsoundness in Rust code in the Linux kernel. The tool
internally uses an LLM to detect bugs.
We then perform manual analysis to verify these reports.
FerroLens reported the following bug in rust/kernel/soc.rs:
`Registration::new()` calls the C function `soc_device_register()`
to register a SoC device with the SoC core. It passes a pointer to the
`soc_device_attribute` object of its pinned `BuiltAttributes` object.
In `soc_device_register()`, if the SoC bus is not registered, this pointer
argument is saved in a global variable `early_soc_dev_attr` for deferred
registration and NULL is returned.
If `Registration::new()` receives a NULL pointer, it produces `EINVAL`,
causing the `BuiltAttributes` object to be dropped. This frees the memory
containing the attribute data, which is still referenced by
`early_soc_dev_attr`. A later call to `soc_device_match()` will dereference
this dangling pointer, resulting in a use-after-free bug.
The SoC bus is normally registered by a core initcall before loadable
modules run, but the condition is reachable if that initcall fails or
is skipped.
Below is a PoC kernel module that demonstrates such a UAF.
"initcall_blacklist=soc_bus_register" is added as a kernel command line
argument to prevent the SoC bus from being registered and trigger the
aforementioned error path. The module attempts
to register a SoC device, which fails with EINVAL. The module then calls
soc_device_match() to check if the SoC device is present, which
results in a UAF.
// SPDX-License-Identifier: GPL-2.0
use kernel::{
prelude::*,
soc::{Attributes, Registration},
str::CString,
bindings
};
module! {
type: SocPoc,
name: "soc_poc",
authors: ["Priya Govindasamy"],
description: "PoC demonstrating potential UAF due to Registration::new()",
license: "GPL",
}
fn matches_soc() -> bool {
let matches = [
bindings::soc_device_attribute {
machine: core::ptr::null(),
family: c"Snapdragon".as_char_ptr(),
revision: core::ptr::null(),
serial_number: core::ptr::null(),
soc_id: c"SM8650".as_char_ptr(),
data: core::ptr::null(),
custom_attr_group: core::ptr::null(),
},
// Required zero-terminated sentinel.
bindings::soc_device_attribute::default(),
];
// SAFETY: `matches` is a valid, zero-terminated array, and all string
// pointers remain valid throughout the call.
let result = unsafe { bindings::soc_device_match(matches.as_ptr()) };
!result.is_null()
}
struct SocPoc {
_registration: Pin<KBox<Registration>>,
}
impl kernel::Module for SocPoc {
fn init(_module: &'static ThisModule) -> Result<Self> {
let attributes = Attributes {
machine: Some(CString::try_from(c"Rust SoC PoC board")?),
family: Some(CString::try_from(c"Rust SoC PoC")?),
revision: Some(CString::try_from(c"1.0")?),
serial_number: Some(CString::try_from(c"0001")?),
soc_id: Some(CString::try_from(c"RUST-SOC-POC")?),
};
let registration = match KBox::pin_init(Registration::new(attributes), GFP_KERNEL) {
Ok(registration) => {
pr_info!("soc_poc: SoC registration succeeded\n");
registration
}
Err(err) => {
pr_err!("soc_poc: SoC registration failed: {err:?}\n");
let _matches_soc = matches_soc();
return Err(err);
}
};
Ok(Self {
_registration: registration,
})
}
}
Output:
[ 226.710823] soc_poc: soc_poc: SoC registration failed: EINVAL
[ 226.710876] ==================================================================
[ 226.710881] BUG: KASAN: slab-use-after-free in soc_device_match_attr+0xb1/0x190
[ 226.710929] Read of size 8 at addr ffff88810c770288 by task insmod/4521
[ 226.710966] CPU: 4 UID: 0 PID: 4521 Comm: insmod Tainted: G OE N 7.3.0-rc5+ #76 PREEMPT(lazy)
[ 226.710974] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE, [N]=TEST
[ 226.710976] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
[ 226.710983] Call Trace:
[ 226.710987] <TASK>
[ 226.710996] dump_stack_lvl+0x97/0xe0
[ 226.711027] print_report+0x175/0x6f0
[ 226.711049] ? __virt_addr_valid+0x18d/0x3b0
[ 226.711070] ? __virt_addr_valid+0x344/0x3b0
[ 226.711074] ? soc_device_match_attr+0xb1/0x190
[ 226.711076] ? kasan_complete_mode_report_info+0x75/0x230
[ 226.711082] ? soc_device_match_attr+0xb1/0x190
[ 226.711085] kasan_report+0xfa/0x130
[ 226.711088] ? soc_device_match_attr+0xb1/0x190
[ 226.711095] __asan_report_load8_noabort+0x18/0x20
[ 226.711099] soc_device_match_attr+0xb1/0x190
[ 226.711102] soc_device_match+0xd1/0x100
[ 226.711106] _RNvXCs6F4l9FIlPI9_7soc_pocNtB2_6SocPocNtNtCsbuTvttuFvbr_6kernel6module6Module4init+0x61b/0x7c0 [soc_poc]
[ 226.711124] init_module+0x15/0xff0 [soc_poc]
[ 226.711128] do_one_initcall+0x119/0x4f0
[ 226.711132] ? do_init_module+0x63/0x740
[ 226.711159] ? __pfx_init_module+0x10/0x10 [soc_poc]
[ 226.711163] ? do_syscall_64+0x11c/0x3f0
[ 226.711183] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711193] ? kvm_sched_clock_read+0x15/0x40
[ 226.711203] ? __lock_acquire+0xeeb/0x1040
[ 226.711219] ? kvm_sched_clock_read+0x15/0x40
[ 226.711223] ? debug_smp_processor_id+0x1b/0x30
[ 226.711227] ? _raw_spin_unlock_irqrestore+0x38/0x90
[ 226.711239] ? __this_cpu_preempt_check+0x17/0x20
[ 226.711242] ? lockdep_hardirqs_on+0xdc/0x160
[ 226.711247] ? debug_smp_processor_id+0x1b/0x30
[ 226.711254] ? kasan_save_alloc_info+0x3a/0x50
[ 226.711257] ? __kasan_kmalloc+0x94/0xb0
[ 226.711261] ? __kmalloc_cache_noprof+0x35b/0x6c0
[ 226.711267] ? do_init_module+0x63/0x740
[ 226.711270] ? __kmalloc_cache_noprof+0x165/0x6c0
[ 226.711272] ? kasan_unpoison+0x4c/0x70
[ 226.711276] ? kasan_poison+0x44/0x60
[ 226.711281] do_init_module+0x23f/0x740
[ 226.711288] load_module+0x32dc/0x3f20
[ 226.711297] __se_sys_finit_module+0x39d/0x5f0
[ 226.711308] __x64_sys_finit_module+0x7f/0x90
[ 226.711312] x64_sys_call+0xa66/0x2600
[ 226.711316] do_syscall_64+0x11c/0x3f0
[ 226.711319] ? vm_mmap_pgoff+0x25d/0x360
[ 226.711336] ? up_write+0x1b4/0x4c0
[ 226.711338] ? __this_cpu_preempt_check+0x17/0x20
[ 226.711343] ? vm_mmap_pgoff+0x269/0x360
[ 226.711348] ? fput+0x60/0x90
[ 226.711358] ? ksys_mmap_pgoff+0x426/0x630
[ 226.711374] ? debug_smp_processor_id+0x1b/0x30
[ 226.711379] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711384] ? __this_cpu_preempt_check+0x17/0x20
[ 226.711387] ? lockdep_hardirqs_on+0xdc/0x160
[ 226.711391] ? debug_smp_processor_id+0x1b/0x30
[ 226.711394] ? rcu_is_watching+0x1a/0xc0
[ 226.711401] ? trace_irq_disable+0x3c/0x130
[ 226.711419] ? do_syscall_64+0x6d/0x3f0
[ 226.711422] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711426] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711429] RIP: 0033:0x7f391451e9dd
[ 226.711440] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 23 b4 0f 00 f7 d8 64 89 01 48
[ 226.711446] RSP: 002b:00007ffd4da673b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 226.711457] RAX: ffffffffffffffda RBX: 000055a3792b57c0 RCX: 00007f391451e9dd
[ 226.711460] RDX: 0000000000000000 RSI: 000055a3514efcd2 RDI: 0000000000000003
[ 226.711462] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 226.711464] R10: 0000000000000003 R11: 0000000000000246 R12: 000055a3514efcd2
[ 226.711466] R13: 000055a3792b5790 R14: 000055a3514ee888 R15: 000055a3792b58d0
[ 226.711473] </TASK>
[ 226.711475] Allocated by task 4521:
[ 226.711481] kasan_save_track+0x2f/0x70
[ 226.711490] kasan_save_alloc_info+0x3a/0x50
[ 226.711492] __kasan_kmalloc+0x94/0xb0
[ 226.711494] __kmalloc_node_track_caller_noprof+0x56c/0x850
[ 226.711497] krealloc_node_align_noprof+0x189/0x3b0
[ 226.711500] rust_helper_krealloc_node_align+0xd/0x20
[ 226.711517] _RNvXCs6F4l9FIlPI9_7soc_pocNtB2_6SocPocNtNtCsbuTvttuFvbr_6kernel6module6Module4init+0x1eb/0x7c0 [soc_poc]
[ 226.711524] init_module+0x15/0xff0 [soc_poc]
[ 226.711527] do_one_initcall+0x119/0x4f0
[ 226.711530] do_init_module+0x23f/0x740
[ 226.711533] load_module+0x32dc/0x3f20
[ 226.711535] __se_sys_finit_module+0x39d/0x5f0
[ 226.711537] __x64_sys_finit_module+0x7f/0x90
[ 226.711539] x64_sys_call+0xa66/0x2600
[ 226.711541] do_syscall_64+0x11c/0x3f0
[ 226.711544] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711547] Freed by task 4521:
[ 226.711549] kasan_save_track+0x2f/0x70
[ 226.711552] kasan_save_free_info+0x44/0x50
[ 226.711555] __kasan_slab_free+0x63/0x90
[ 226.711557] kfree+0x1c3/0x680
[ 226.711565] krealloc_node_align_noprof+0x238/0x3b0
[ 226.711567] rust_helper_krealloc_node_align+0xd/0x20
[ 226.711570] _RNvXCs6F4l9FIlPI9_7soc_pocNtB2_6SocPocNtNtCsbuTvttuFvbr_6kernel6module6Module4init+0x525/0x7c0 [soc_poc]
[ 226.711573] init_module+0x15/0xff0 [soc_poc]
[ 226.711576] do_one_initcall+0x119/0x4f0
[ 226.711579] do_init_module+0x23f/0x740
[ 226.711581] load_module+0x32dc/0x3f20
[ 226.711583] __se_sys_finit_module+0x39d/0x5f0
[ 226.711585] __x64_sys_finit_module+0x7f/0x90
[ 226.711587] x64_sys_call+0xa66/0x2600
[ 226.711589] do_syscall_64+0x11c/0x3f0
[ 226.711592] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 226.711595] The buggy address belongs to the object at ffff88810c770200
which belongs to the cache kmalloc-192 of size 192
[ 226.711601] The buggy address is located 136 bytes inside of
freed 192-byte region [ffff88810c770200, ffff88810c7702c0)
[ 226.711605] The buggy address belongs to the physical page:
[ 226.711613] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c770
[ 226.711627] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 226.711630] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
[ 226.711637] page_type: f5(slab)
[ 226.711656] raw: 0017ffffc0000040 ffff8881000423c0 dead000000000100 dead000000000122
[ 226.711659] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 226.711661] head: 0017ffffc0000040 ffff8881000423c0 dead000000000100 dead000000000122
[ 226.711663] head: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 226.711665] head: 0017ffffc0000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 226.711667] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 226.711668] page dumped because: kasan: bad access detected
[ 226.711676] Memory state around the buggy address:
[ 226.711681] ffff88810c770180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 226.711682] ffff88810c770200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 226.711687] >ffff88810c770280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 226.711688] ^
[ 226.711690] ffff88810c770300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 226.711692] ffff88810c770380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 226.711693] ==================================================================
[ 226.711696] Disabling lock debugging due to kernel taint
Priya Bala Govindasamy (1):
rust: soc: avoid dangling attributes when SoC bus is unavailable
drivers/base/soc.c | 19 ++++++++++++++++++-
include/linux/sys_soc.h | 18 ++++++++++++++++++
rust/kernel/soc.rs | 7 ++++---
3 files changed, 40 insertions(+), 4 deletions(-)
--
2.34.1
next reply other threads:[~2026-10-27 17:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 17:48 Priya Bala Govindasamy [this message]
2026-10-27 17:48 ` [PATCH 1/1] rust: soc: avoid dangling attributes when SoC bus is unavailable Priya Bala Govindasamy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1792628232.git.pgovind2@uci.edu \
--to=pgovind2@uci.edu \
--cc=a.hindborg@kernel.org \
--cc=acourbot@nvidia.com \
--cc=aliceryhl@google.com \
--cc=ardalan@uci.edu \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun@kernel.org \
--cc=dakr@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=driver-core@lists.linux.dev \
--cc=dzueck@uci.edu \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=lossin@kernel.org \
--cc=mmaurer@google.com \
--cc=ojeda@kernel.org \
--cc=rafael@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=tamird@kernel.org \
--cc=tmgross@umich.edu \
--cc=work@onurozkan.dev \
--cc=zhiyunq@cs.ucr.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.