[PATCH] firmware: arm_scmi: fix slab-use-after-free in scmi_bus_notifier

[PATCH] firmware: arm_scmi: fix slab-use-after-free in scmi_bus_notifier

[Xinqi Zhang]

Move release of scmi_dev->name into scmi_device_release to
avoid slab-use-after-free.

==================================================================
BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1

CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
Call trace:
 dump_backtrace+0x94/0x114
 show_stack+0x18/0x24
 dump_stack_lvl+0x48/0x60
 print_report+0xf4/0x5b0
 kasan_report+0xa4/0xec
 __asan_report_load1_noabort+0x20/0x2c
 strncmp+0xe4/0xec
 scmi_bus_notifier+0x5c/0x54c
 notifier_call_chain+0xb4/0x31c
 blocking_notifier_call_chain+0x68/0x9c
 bus_notify+0x54/0x78
 device_del+0x1bc/0x840
 device_unregister+0x20/0xb4
 __scmi_device_destroy+0xac/0x280
 scmi_device_destroy+0x94/0xd0
 scmi_chan_setup+0x524/0x750
 scmi_probe+0x7fc/0x1508
 platform_probe+0xc4/0x19c
 really_probe+0x32c/0x99c
 __driver_probe_device+0x15c/0x3c4
 driver_probe_device+0x5c/0x170
 __driver_attach+0x1c8/0x440
 bus_for_each_dev+0xf4/0x178
 driver_attach+0x3c/0x58
 bus_add_driver+0x234/0x4d4
 driver_register+0xf4/0x3c0
 __platform_driver_register+0x60/0x88
 scmi_driver_init+0xb0/0x104
 do_one_initcall+0xb4/0x664
 kernel_init_freeable+0x3c8/0x894
 kernel_init+0x24/0x1e8
 ret_from_fork+0x10/0x20

Allocated by task 1:
 kasan_save_stack+0x2c/0x54
 kasan_set_track+0x2c/0x40
 kasan_save_alloc_info+0x24/0x34
 __kasan_kmalloc+0xa0/0xb8
 __kmalloc_node_track_caller+0x6c/0x104
 kstrdup+0x48/0x84
 kstrdup_const+0x34/0x40
 __scmi_device_create.part.0+0x8c/0x408
 scmi_device_create+0x104/0x370
 scmi_chan_setup+0x2a0/0x750
 scmi_probe+0x7fc/0x1508
 platform_probe+0xc4/0x19c
 really_probe+0x32c/0x99c
 __driver_probe_device+0x15c/0x3c4
 driver_probe_device+0x5c/0x170
 __driver_attach+0x1c8/0x440
 bus_for_each_dev+0xf4/0x178
 driver_attach+0x3c/0x58
 bus_add_driver+0x234/0x4d4
 driver_register+0xf4/0x3c0
 __platform_driver_register+0x60/0x88
 scmi_driver_init+0xb0/0x104
 do_one_initcall+0xb4/0x664
 kernel_init_freeable+0x3c8/0x894
 kernel_init+0x24/0x1e8
 ret_from_fork+0x10/0x20

Freed by task 1:
 kasan_save_stack+0x2c/0x54
 kasan_set_track+0x2c/0x40
 kasan_save_free_info+0x38/0x5c
 __kasan_slab_free+0xe8/0x164
 __kmem_cache_free+0x11c/0x230
 kfree+0x70/0x130
 kfree_const+0x20/0x40
 __scmi_device_destroy+0x70/0x280
 scmi_device_destroy+0x94/0xd0
 scmi_chan_setup+0x524/0x750
 scmi_probe+0x7fc/0x1508
 platform_probe+0xc4/0x19c
 really_probe+0x32c/0x99c
 __driver_probe_device+0x15c/0x3c4
 driver_probe_device+0x5c/0x170
 __driver_attach+0x1c8/0x440
 bus_for_each_dev+0xf4/0x178
 driver_attach+0x3c/0x58
 bus_add_driver+0x234/0x4d4
 driver_register+0xf4/0x3c0
 __platform_driver_register+0x60/0x88
 scmi_driver_init+0xb0/0x104
 do_one_initcall+0xb4/0x664
 kernel_init_freeable+0x3c8/0x894
 kernel_init+0x24/0x1e8
 ret_from_fork+0x10/0x20

Signed-off-by: Xinqi Zhang <quic_xinqzhan@quicinc.com>
---
 drivers/firmware/arm_scmi/bus.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
index 96b2e5f9a8ef0386525f9d91d2925e7e6d48ac28..157172a5f2b577ce4f04425f967f548230c1ebed 100644
--- a/drivers/firmware/arm_scmi/bus.c
+++ b/drivers/firmware/arm_scmi/bus.c
@@ -325,7 +325,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
 
 static void scmi_device_release(struct device *dev)
 {
-	kfree(to_scmi_dev(dev));
+	struct scmi_device *scmi_dev = to_scmi_dev(dev);
+
+	kfree_const(scmi_dev->name);
+	kfree(scmi_dev);
 }
 
 static void __scmi_device_destroy(struct scmi_device *scmi_dev)
@@ -338,7 +341,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
 	if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
 		atomic_set(&scmi_syspower_registered, 0);
 
-	kfree_const(scmi_dev->name);
 	ida_free(&scmi_bus_id, scmi_dev->id);
 	device_unregister(&scmi_dev->dev);
 }
@@ -410,7 +412,6 @@ __scmi_device_create(struct device_node *np, struct device *parent,
 
 	return scmi_dev;
 put_dev:
-	kfree_const(scmi_dev->name);
 	put_device(&scmi_dev->dev);
 	ida_free(&scmi_bus_id, id);
 	return NULL;

---
base-commit: eca631b8fe808748d7585059c4307005ca5c5820
change-id: 20241015-fix-arm-scmi-slab-use-after-free-74e358b3c90c

Best regards,
-- 
Xinqi Zhang <quic_xinqzhan@quicinc.com>

Re: [PATCH] firmware: arm_scmi: fix slab-use-after-free in scmi_bus_notifier

[Cristian Marussi]

On Tue, Oct 15, 2024 at 06:48:25PM +0800, Xinqi Zhang wrote:
> Move release of scmi_dev->name into scmi_device_release to
> avoid slab-use-after-free.
> 

Hi,

Thanks for reporting this.

Can you add a bit more of conetxt in the commit message on when this
happens ? From the stacktrace seems related to an early chan_setup failure
and the subsequent complete shutdown of the SCMI stack.

And also a Fixes tag would be useful.

Thanks,
Cristian