Re: [PATCH] firmware: arm_scmi: fix slab-use-after-free in scmi_bus_notifier

[Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>]

On Tue, Oct 15, 2024 at 04:48:26PM +0800, Xinqi Zhang wrote:

Hi Xinqi,

It seems you got linux-arm-msm@vger.kernel.org in your recipients list
when I believe you tried to send only to kernel@quicinc.com? Your patch
looks good, so please expand your commit message a bit and resubmit this
to the full list of recipients suggested by the tools.

> Move release of scmi_dev->name into scmi_device_release to
> avoid slab-use-after-free.

Please provide a sentence describing the problem you're solving before
this technical description of proposed solution, and add () suffix to
function names.

Regards,
Bjorn

> 
> ==================================================================
> BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
> Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
> 
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
> Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
> Call trace:
>  dump_backtrace+0x94/0x114
>  show_stack+0x18/0x24
>  dump_stack_lvl+0x48/0x60
>  print_report+0xf4/0x5b0
>  kasan_report+0xa4/0xec
>  __asan_report_load1_noabort+0x20/0x2c
>  strncmp+0xe4/0xec
>  scmi_bus_notifier+0x5c/0x54c
>  notifier_call_chain+0xb4/0x31c
>  blocking_notifier_call_chain+0x68/0x9c
>  bus_notify+0x54/0x78
>  device_del+0x1bc/0x840
>  device_unregister+0x20/0xb4
>  __scmi_device_destroy+0xac/0x280
>  scmi_device_destroy+0x94/0xd0
>  scmi_chan_setup+0x524/0x750
>  scmi_probe+0x7fc/0x1508
>  platform_probe+0xc4/0x19c
>  really_probe+0x32c/0x99c
>  __driver_probe_device+0x15c/0x3c4
>  driver_probe_device+0x5c/0x170
>  __driver_attach+0x1c8/0x440
>  bus_for_each_dev+0xf4/0x178
>  driver_attach+0x3c/0x58
>  bus_add_driver+0x234/0x4d4
>  driver_register+0xf4/0x3c0
>  __platform_driver_register+0x60/0x88
>  scmi_driver_init+0xb0/0x104
>  do_one_initcall+0xb4/0x664
>  kernel_init_freeable+0x3c8/0x894
>  kernel_init+0x24/0x1e8
>  ret_from_fork+0x10/0x20
> 
> Allocated by task 1:
>  kasan_save_stack+0x2c/0x54
>  kasan_set_track+0x2c/0x40
>  kasan_save_alloc_info+0x24/0x34
>  __kasan_kmalloc+0xa0/0xb8
>  __kmalloc_node_track_caller+0x6c/0x104
>  kstrdup+0x48/0x84
>  kstrdup_const+0x34/0x40
>  __scmi_device_create.part.0+0x8c/0x408
>  scmi_device_create+0x104/0x370
>  scmi_chan_setup+0x2a0/0x750
>  scmi_probe+0x7fc/0x1508
>  platform_probe+0xc4/0x19c
>  really_probe+0x32c/0x99c
>  __driver_probe_device+0x15c/0x3c4
>  driver_probe_device+0x5c/0x170
>  __driver_attach+0x1c8/0x440
>  bus_for_each_dev+0xf4/0x178
>  driver_attach+0x3c/0x58
>  bus_add_driver+0x234/0x4d4
>  driver_register+0xf4/0x3c0
>  __platform_driver_register+0x60/0x88
>  scmi_driver_init+0xb0/0x104
>  do_one_initcall+0xb4/0x664
>  kernel_init_freeable+0x3c8/0x894
>  kernel_init+0x24/0x1e8
>  ret_from_fork+0x10/0x20
> 
> Freed by task 1:
>  kasan_save_stack+0x2c/0x54
>  kasan_set_track+0x2c/0x40
>  kasan_save_free_info+0x38/0x5c
>  __kasan_slab_free+0xe8/0x164
>  __kmem_cache_free+0x11c/0x230
>  kfree+0x70/0x130
>  kfree_const+0x20/0x40
>  __scmi_device_destroy+0x70/0x280
>  scmi_device_destroy+0x94/0xd0
>  scmi_chan_setup+0x524/0x750
>  scmi_probe+0x7fc/0x1508
>  platform_probe+0xc4/0x19c
>  really_probe+0x32c/0x99c
>  __driver_probe_device+0x15c/0x3c4
>  driver_probe_device+0x5c/0x170
>  __driver_attach+0x1c8/0x440
>  bus_for_each_dev+0xf4/0x178
>  driver_attach+0x3c/0x58
>  bus_add_driver+0x234/0x4d4
>  driver_register+0xf4/0x3c0
>  __platform_driver_register+0x60/0x88
>  scmi_driver_init+0xb0/0x104
>  do_one_initcall+0xb4/0x664
>  kernel_init_freeable+0x3c8/0x894
>  kernel_init+0x24/0x1e8
>  ret_from_fork+0x10/0x20
> 
> Signed-off-by: Xinqi Zhang <quic_xinqzhan@quicinc.com>
> ---
>  drivers/firmware/arm_scmi/bus.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c
> index 96b2e5f9a8ef0386525f9d91d2925e7e6d48ac28..157172a5f2b577ce4f04425f967f548230c1ebed 100644
> --- a/drivers/firmware/arm_scmi/bus.c
> +++ b/drivers/firmware/arm_scmi/bus.c
> @@ -325,7 +325,10 @@ EXPORT_SYMBOL_GPL(scmi_driver_unregister);
>  
>  static void scmi_device_release(struct device *dev)
>  {
> -	kfree(to_scmi_dev(dev));
> +	struct scmi_device *scmi_dev = to_scmi_dev(dev);
> +
> +	kfree_const(scmi_dev->name);
> +	kfree(scmi_dev);
>  }
>  
>  static void __scmi_device_destroy(struct scmi_device *scmi_dev)
> @@ -338,7 +341,6 @@ static void __scmi_device_destroy(struct scmi_device *scmi_dev)
>  	if (scmi_dev->protocol_id == SCMI_PROTOCOL_SYSTEM)
>  		atomic_set(&scmi_syspower_registered, 0);
>  
> -	kfree_const(scmi_dev->name);
>  	ida_free(&scmi_bus_id, scmi_dev->id);
>  	device_unregister(&scmi_dev->dev);
>  }
> @@ -410,7 +412,6 @@ __scmi_device_create(struct device_node *np, struct device *parent,
>  
>  	return scmi_dev;
>  put_dev:
> -	kfree_const(scmi_dev->name);
>  	put_device(&scmi_dev->dev);
>  	ida_free(&scmi_bus_id, id);
>  	return NULL;
> 
> ---
> base-commit: eca631b8fe808748d7585059c4307005ca5c5820
> change-id: 20241015-fix_scmi_slab_use_after_free-4709d743931b
> 
> Best regards,
> -- 
> Xinqi Zhang <quic_xinqzhan@quicinc.com>
>