From: Stephen Boyd <sboyd@kernel.org>
To: James Lo <james.lo@mediatek.com>,
Matthias Brugger <matthias.bgg@gmail.com>,
Yu-Che Cheng <giver@chromium.org>
Cc: Yu-Che Cheng <giver@chromium.org>, Fei Shao <fshao@chromium.org>,
AngeloGioacchino Del Regno
<angelogioacchino.delregno@collabora.com>,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org
Subject: Re: [PATCH] spmi: mediatek: Fix UAF on device remove
Date: Mon, 23 Oct 2023 19:01:36 -0700 [thread overview]
Message-ID: <c113be74d0ad1a7c94d313716e2fb8bd.sboyd@kernel.org> (raw)
In-Reply-To: <20230717173934.1.If004a6e055a189c7f2d0724fa814422c26789839@changeid>
Quoting Yu-Che Cheng (2023-07-17 02:39:35)
> The pmif driver data that contains the clocks is allocated along with
> spmi_controller.
> On device remove, spmi_controller will be freed first, and then devres
> , including the clocks, will be cleanup.
> This leads to UAF because putting the clocks will access the clocks in
> the pmif driver data, which is already freed along with spmi_controller.
>
> This can be reproduced by enabling DEBUG_TEST_DRIVER_REMOVE and
> building the kernel with KASAN.
>
> Fix the UAF issue by using unmanaged clk_bulk_get() and putting the
> clocks before freeing spmi_controller.
>
> Reported-by: Fei Shao <fshao@chromium.org>
> Signed-off-by: Yu-Che Cheng <giver@chromium.org>
> ---
Applied to spmi-next
prev parent reply other threads:[~2023-10-24 2:01 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-17 9:39 [PATCH] spmi: mediatek: Fix UAF on device remove Yu-Che Cheng
2023-07-18 6:57 ` Fei Shao
2023-08-18 5:09 ` Fei Shao
2023-08-21 3:35 ` Chen-Yu Tsai
2023-08-21 6:18 ` Fei Shao
2023-10-24 2:01 ` Stephen Boyd [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c113be74d0ad1a7c94d313716e2fb8bd.sboyd@kernel.org \
--to=sboyd@kernel.org \
--cc=angelogioacchino.delregno@collabora.com \
--cc=fshao@chromium.org \
--cc=giver@chromium.org \
--cc=james.lo@mediatek.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=matthias.bgg@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox