From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vincent Whitchurch <vincent.whitchurch@axis.com>,
Alexandre Belloni <alexandre.belloni@bootlin.com>,
Sasha Levin <sashal@kernel.org>,
a.zummo@towertech.it, linux-rtc@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 02/27] rtc: fix use-after-free on device removal
Date: Wed, 6 Apr 2022 21:12:32 -0400 [thread overview]
Message-ID: <20220407011257.114287-2-sashal@kernel.org> (raw)
In-Reply-To: <20220407011257.114287-1-sashal@kernel.org>
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
[ Upstream commit c8fa17d9f08a448184f03d352145099b5beb618e ]
If the irqwork is still scheduled or running while the RTC device is
removed, a use-after-free occurs in rtc_timer_do_work(). Cleanup the
timerqueue and ensure the work is stopped to fix this.
BUG: KASAN: use-after-free in mutex_lock+0x94/0x110
Write of size 8 at addr ffffff801d846338 by task kworker/3:1/41
Workqueue: events rtc_timer_do_work
Call trace:
mutex_lock+0x94/0x110
rtc_timer_do_work+0xec/0x630
process_one_work+0x5fc/0x1344
...
Allocated by task 551:
kmem_cache_alloc_trace+0x384/0x6e0
devm_rtc_allocate_device+0xf0/0x574
devm_rtc_device_register+0x2c/0x12c
...
Freed by task 572:
kfree+0x114/0x4d0
rtc_device_release+0x64/0x80
device_release+0x8c/0x1f4
kobject_put+0x1c4/0x4b0
put_device+0x20/0x30
devm_rtc_release_device+0x1c/0x30
devm_action_release+0x54/0x90
release_nodes+0x124/0x310
devres_release_group+0x170/0x240
i2c_device_remove+0xd8/0x314
...
Last potentially related work creation:
insert_work+0x5c/0x330
queue_work_on+0xcc/0x154
rtc_set_time+0x188/0x5bc
rtc_dev_ioctl+0x2ac/0xbd0
...
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211210160951.7718-1-vincent.whitchurch@axis.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/class.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index f77bc089eb6b..0aef7df2ea70 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -26,6 +26,15 @@ struct class *rtc_class;
static void rtc_device_release(struct device *dev)
{
struct rtc_device *rtc = to_rtc_device(dev);
+ struct timerqueue_head *head = &rtc->timerqueue;
+ struct timerqueue_node *node;
+
+ mutex_lock(&rtc->ops_lock);
+ while ((node = timerqueue_getnext(head)))
+ timerqueue_del(head, node);
+ mutex_unlock(&rtc->ops_lock);
+
+ cancel_work_sync(&rtc->irqwork);
ida_simple_remove(&rtc_ida, rtc->id);
mutex_destroy(&rtc->ops_lock);
--
2.35.1
next prev parent reply other threads:[~2022-04-07 1:19 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-07 1:12 [PATCH AUTOSEL 5.15 01/27] gfs2: assign rgrp glock before compute_bitstructs Sasha Levin
2022-04-07 1:12 ` Sasha Levin [this message]
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 03/27] rtc: pcf2127: fix bug when reading alarm registers Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 04/27] um: Cleanup syscall_handler_t definition/cast, fix warning Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 05/27] um: port_user: Improve error handling when port-helper is not found Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 06/27] Input: add bounds checking to input_set_capability() Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 07/27] Input: stmfts - fix reference leak in stmfts_input_open Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 08/27] nvme-pci: add quirks for Samsung X5 SSDs Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 09/27] gfs2: Disable page faults during lockless buffered reads Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 10/27] rtc: sun6i: Fix time overflow handling Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 11/27] crypto: stm32 - fix reference leak in stm32_crc_remove Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 12/27] crypto: x86/chacha20 - Avoid spurious jumps to other functions Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 13/27] ALSA: hda/realtek: Enable headset mic on Lenovo P360 Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 14/27] s390/traps: improve panic message for translation-specification exception Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 15/27] s390/pci: improve zpci_dev reference counting Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 16/27] vhost_vdpa: don't setup irq offloading when irq_num < 0 Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 17/27] tools/virtio: compile with -pthread Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 18/27] nvmet: use a private workqueue instead of the system workqueue Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 19/27] nvme-multipath: fix hang when disk goes live over reconnect Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 20/27] rtc: mc146818-lib: Fix the AltCentury for AMD platforms Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 21/27] fs: fix an infinite loop in iomap_fiemap Sasha Levin
2022-04-07 11:28 ` Amir Goldstein
2022-04-07 11:30 ` Amir Goldstein
2022-05-17 17:33 ` Amir Goldstein
2022-05-18 12:24 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 22/27] MIPS: lantiq: check the return value of kzalloc() Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 23/27] drbd: remove usage of list iterator variable after loop Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 24/27] platform/chrome: cros_ec_debugfs: detach log reader wq from devm Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 25/27] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 26/27] nilfs2: fix lockdep warnings in page operations for btree nodes Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 27/27] nilfs2: fix lockdep warnings during disk space reclamation Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220407011257.114287-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=a.zummo@towertech.it \
--cc=alexandre.belloni@bootlin.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rtc@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vincent.whitchurch@axis.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox