From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, John Garry <john.garry@huawei.com>,
"Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
Subject: [PATCH 4.19 56/93] ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit()
Date: Sun, 27 Oct 2019 22:01:08 +0100 [thread overview]
Message-ID: <20191027203302.306603006@linuxfoundation.org> (raw)
In-Reply-To: <20191027203251.029297948@linuxfoundation.org>
From: John Garry <john.garry@huawei.com>
commit 56a0b978d42f58c7e3ba715cf65af487d427524d upstream.
When enabling KASAN and DEBUG_TEST_DRIVER_REMOVE, I find this KASAN
warning:
[ 20.872057] BUG: KASAN: use-after-free in pcc_data_alloc+0x40/0xb8
[ 20.878226] Read of size 4 at addr ffff00236cdeb684 by task swapper/0/1
[ 20.884826]
[ 20.886309] CPU: 19 PID: 1 Comm: swapper/0 Not tainted 5.4.0-rc1-00009-ge7f7df3db5bf-dirty #289
[ 20.894994] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.16.01 03/15/2019
[ 20.903505] Call trace:
[ 20.905942] dump_backtrace+0x0/0x200
[ 20.909593] show_stack+0x14/0x20
[ 20.912899] dump_stack+0xd4/0x130
[ 20.916291] print_address_description.isra.9+0x6c/0x3b8
[ 20.921592] __kasan_report+0x12c/0x23c
[ 20.925417] kasan_report+0xc/0x18
[ 20.928808] __asan_load4+0x94/0xb8
[ 20.932286] pcc_data_alloc+0x40/0xb8
[ 20.935938] acpi_cppc_processor_probe+0x4e8/0xb08
[ 20.940717] __acpi_processor_start+0x48/0xb0
[ 20.945062] acpi_processor_start+0x40/0x60
[ 20.949235] really_probe+0x118/0x548
[ 20.952887] driver_probe_device+0x7c/0x148
[ 20.957059] device_driver_attach+0x94/0xa0
[ 20.961231] __driver_attach+0xa4/0x110
[ 20.965055] bus_for_each_dev+0xe8/0x158
[ 20.968966] driver_attach+0x30/0x40
[ 20.972531] bus_add_driver+0x234/0x2f0
[ 20.976356] driver_register+0xbc/0x1d0
[ 20.980182] acpi_processor_driver_init+0x40/0xe4
[ 20.984875] do_one_initcall+0xb4/0x254
[ 20.988700] kernel_init_freeable+0x24c/0x2f8
[ 20.993047] kernel_init+0x10/0x118
[ 20.996524] ret_from_fork+0x10/0x18
[ 21.000087]
[ 21.001567] Allocated by task 1:
[ 21.004785] save_stack+0x28/0xc8
[ 21.008089] __kasan_kmalloc.isra.9+0xbc/0xd8
[ 21.012435] kasan_kmalloc+0xc/0x18
[ 21.015913] pcc_data_alloc+0x94/0xb8
[ 21.019564] acpi_cppc_processor_probe+0x4e8/0xb08
[ 21.024343] __acpi_processor_start+0x48/0xb0
[ 21.028689] acpi_processor_start+0x40/0x60
[ 21.032860] really_probe+0x118/0x548
[ 21.036512] driver_probe_device+0x7c/0x148
[ 21.040684] device_driver_attach+0x94/0xa0
[ 21.044855] __driver_attach+0xa4/0x110
[ 21.048680] bus_for_each_dev+0xe8/0x158
[ 21.052591] driver_attach+0x30/0x40
[ 21.056155] bus_add_driver+0x234/0x2f0
[ 21.059980] driver_register+0xbc/0x1d0
[ 21.063805] acpi_processor_driver_init+0x40/0xe4
[ 21.068497] do_one_initcall+0xb4/0x254
[ 21.072322] kernel_init_freeable+0x24c/0x2f8
[ 21.076667] kernel_init+0x10/0x118
[ 21.080144] ret_from_fork+0x10/0x18
[ 21.083707]
[ 21.085186] Freed by task 1:
[ 21.088056] save_stack+0x28/0xc8
[ 21.091360] __kasan_slab_free+0x118/0x180
[ 21.095445] kasan_slab_free+0x10/0x18
[ 21.099183] kfree+0x80/0x268
[ 21.102139] acpi_cppc_processor_exit+0x1a8/0x1b8
[ 21.106832] acpi_processor_stop+0x70/0x80
[ 21.110917] really_probe+0x174/0x548
[ 21.114568] driver_probe_device+0x7c/0x148
[ 21.118740] device_driver_attach+0x94/0xa0
[ 21.122912] __driver_attach+0xa4/0x110
[ 21.126736] bus_for_each_dev+0xe8/0x158
[ 21.130648] driver_attach+0x30/0x40
[ 21.134212] bus_add_driver+0x234/0x2f0
[ 21.0x10/0x18
[ 21.161764]
[ 21.163244] The buggy address belongs to the object at ffff00236cdeb600
[ 21.163244] which belongs to the cache kmalloc-256 of size 256
[ 21.175750] The buggy address is located 132 bytes inside of
[ 21.175750] 256-byte region [ffff00236cdeb600, ffff00236cdeb700)
[ 21.187473] The buggy address belongs to the page:
[ 21.192254] page:fffffe008d937a00 refcount:1 mapcount:0 mapping:ffff002370c0fa00 index:0x0 compound_mapcount: 0
[ 21.202331] flags: 0x1ffff00000010200(slab|head)
[ 21.206940] raw: 1ffff00000010200 dead000000000100 dead000000000122 ffff002370c0fa00
[ 21.214671] raw: 0000000000000000 00000000802a002a 00000001ffffffff 0000000000000000
[ 21.222400] page dumped because: kasan: bad access detected
[ 21.227959]
[ 21.229438] Memory state around the buggy address:
[ 21.234218] ffff00236cdeb580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.241427] ffff00236cdeb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 21.248637] >ffff00236cdeb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 21.255845] ^
[ 21.259062] ffff00236cdeb700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 21.266272] ffff00236cdeb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 21.273480] ==================================================================
It seems that global pcc_data[pcc_ss_id] can be freed in
acpi_cppc_processor_exit(), but we may later reference this value, so
NULLify it when freed.
Also remove the useless setting of data "pcc_channel_acquired", which
we're about to free.
Fixes: 85b1407bf6d2 ("ACPI / CPPC: Make CPPC ACPI driver aware of PCC subspace IDs")
Signed-off-by: John Garry <john.garry@huawei.com>
Cc: 4.15+ <stable@vger.kernel.org> # 4.15+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/cppc_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/cppc_acpi.c
+++ b/drivers/acpi/cppc_acpi.c
@@ -909,8 +909,8 @@ void acpi_cppc_processor_exit(struct acp
pcc_data[pcc_ss_id]->refcount--;
if (!pcc_data[pcc_ss_id]->refcount) {
pcc_mbox_free_channel(pcc_data[pcc_ss_id]->pcc_channel);
- pcc_data[pcc_ss_id]->pcc_channel_acquired = 0;
kfree(pcc_data[pcc_ss_id]);
+ pcc_data[pcc_ss_id] = NULL;
}
}
}
next prev parent reply other threads:[~2019-10-27 21:32 UTC|newest]
Thread overview: 107+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-27 21:00 [PATCH 4.19 00/93] 4.19.81-stable review Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 01/93] nvme-pci: Fix a race in controller removal Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 02/93] scsi: ufs: skip shutdown if hba is not powered Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 03/93] scsi: megaraid: disable device when probe failed after enabled device Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 04/93] scsi: qla2xxx: Fix unbound sleep in fcport delete path Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 05/93] ARM: OMAP2+: Fix missing reset done flag for am3 and am43 Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 06/93] ARM: OMAP2+: Fix warnings with broken omap2_set_init_voltage() Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 07/93] ieee802154: ca8210: prevent memory leak Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 08/93] ARM: dts: am4372: Set memory bandwidth limit for DISPC Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 09/93] net: dsa: qca8k: Use up to 7 ports for all operations Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 10/93] MIPS: dts: ar9331: fix interrupt-controller size Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 11/93] xen/efi: Set nonblocking callbacks Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 12/93] nl80211: fix null pointer dereference Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 13/93] mac80211: fix txq " Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 14/93] netfilter: nft_connlimit: disable bh on garbage collection Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 15/93] net: dsa: rtl8366rb: add missing of_node_put after calling of_get_child_by_name Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 16/93] mips: Loongson: Fix the link time qualifier of serial_exit() Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 17/93] net: hisilicon: Fix usage of uninitialized variable in function mdio_sc_cfg_reg_write() Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 18/93] lib: textsearch: fix escapes in example code Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 19/93] r8152: Set macpassthru in reset_resume callback Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 20/93] namespace: fix namespace.pl script to support relative paths Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 21/93] libata/ahci: Fix PCS quirk application Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 22/93] md/raid0: fix warning message for parameter default_layout Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 23/93] Revert "drm/radeon: Fix EEH during kexec" Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 24/93] ocfs2: fix panic due to ocfs2_wq is null Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 25/93] ipv4: fix race condition between route lookup and invalidation Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 26/93] ipv4: Return -ENETUNREACH if we cant create route but saddr is valid Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 27/93] net: avoid potential infinite loop in tc_ctl_action() Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 28/93] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 29/93] net: bcmgenet: Set phydev->dev_flags only for internal PHYs Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 30/93] net: i82596: fix dma_alloc_attr for sni_82596 Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 31/93] net/ibmvnic: Fix EOI when running in XIVE mode Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 32/93] net: ipv6: fix listify ip6_rcv_finish in case of forwarding Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 33/93] net: stmmac: disable/enable ptp_ref_clk in suspend/resume flow Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 34/93] sctp: change sctp_prot .no_autobind with true Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 35/93] memfd: Fix locking when tagging pins Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 36/93] USB: legousbtower: fix memleak on disconnect Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 37/93] ALSA: hda/realtek - Add support for ALC711 Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 38/93] ALSA: hda/realtek - Enable headset mic on Asus MJ401TA Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 39/93] ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 40/93] ALSA: hda - Force runtime PM on Nvidia HDMI codecs Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 41/93] usb: udc: lpc32xx: fix bad bit shift operation Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 42/93] USB: serial: ti_usb_3410_5052: fix port-close races Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 43/93] USB: ldusb: fix memleak on disconnect Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 44/93] USB: usblp: fix use-after-free " Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 45/93] USB: ldusb: fix read info leaks Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 46/93] MIPS: tlbex: Fix build_restore_pagemask KScratch restore Greg Kroah-Hartman
2019-10-27 21:00 ` [PATCH 4.19 47/93] staging: wlan-ng: fix exit return when sme->key_idx >= NUM_WEPKEYS Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 48/93] scsi: zfcp: fix reaction on bit error threshold notification Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 49/93] scsi: sd: Ignore a failure to sync cache due to lack of authorization Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 50/93] scsi: core: save/restore command resid for error handling Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 51/93] scsi: core: try to get module before removing device Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 52/93] scsi: ch: Make it possible to open a ch device multiple times again Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 53/93] Input: da9063 - fix capability and drop KEY_SLEEP Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 54/93] Input: synaptics-rmi4 - avoid processing unknown IRQs Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 55/93] ASoC: rsnd: Reinitialize bit clock inversion flag for every format setting Greg Kroah-Hartman
2019-10-27 21:01 ` Greg Kroah-Hartman [this message]
2019-10-27 21:01 ` [PATCH 4.19 57/93] cfg80211: wext: avoid copying malformed SSIDs Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 58/93] mac80211: Reject malformed SSID elements Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 59/93] drm/edid: Add 6 bpc quirk for SDC panel in Lenovo G50 Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 60/93] drm/ttm: Restore ttm prefaulting Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 61/93] drm/amdgpu: Bail earlier when amdgpu.cik_/si_support is not set to 1 Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 62/93] drivers/base/memory.c: dont access uninitialized memmaps in soft_offline_page_store() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 63/93] fs/proc/page.c: dont access uninitialized memmaps in fs/proc/page.c Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 64/93] mmc: cqhci: Commit descriptors before setting the doorbell Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 65/93] mm/memory-failure.c: dont access uninitialized memmaps in memory_failure() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 66/93] mm/slub: fix a deadlock in show_slab_objects() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 67/93] mm/page_owner: dont access uninitialized memmaps when reading /proc/pagetypeinfo Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 68/93] hugetlbfs: dont access uninitialized memmaps in pfn_range_valid_gigantic() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 69/93] mm/memory-failure: poison read receives SIGKILL instead of SIGBUS if mmaped more than once Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 70/93] xtensa: drop EXPORT_SYMBOL for outs*/ins* Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 71/93] parisc: Fix vmap memory leak in ioremap()/iounmap() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 72/93] EDAC/ghes: Fix Use after free in ghes_edac remove path Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 73/93] arm64: Enable workaround for Cavium TX2 erratum 219 when running SMT Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 74/93] CIFS: avoid using MID 0xFFFF Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 75/93] CIFS: Fix use after free of file info structures Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 76/93] perf/aux: Fix AUX output stopping Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 77/93] tracing: Fix race in perf_trace_buf initialization Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 78/93] dm cache: fix bugs when a GFP_NOWAIT allocation fails Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 79/93] x86/boot/64: Make level2_kernel_pgt pages invalid outside kernel area Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 80/93] x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 81/93] pinctrl: cherryview: restore Strago DMI workaround for all versions Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 82/93] pinctrl: armada-37xx: fix control of pins 32 and up Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 83/93] pinctrl: armada-37xx: swap polarity on LED group Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 84/93] btrfs: block-group: Fix a memory leak due to missing btrfs_put_block_group() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 85/93] Btrfs: add missing extents release on file extent cluster relocation error Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 86/93] Btrfs: check for the full sync flag while holding the inode lock during fsync Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 87/93] btrfs: tracepoints: Fix bad entry members of qgroup events Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 88/93] memstick: jmb38x_ms: Fix an error handling path in jmb38x_ms_probe() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 89/93] cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 90/93] xen/netback: fix error path of xenvif_connect_data() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 91/93] PCI: PM: Fix pci_power_up() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 92/93] blk-rq-qos: fix first node deletion of rq_qos_del() Greg Kroah-Hartman
2019-10-27 21:01 ` [PATCH 4.19 93/93] RDMA/cxgb4: Do not dma memory off of the stack Greg Kroah-Hartman
2019-10-28 2:15 ` [PATCH 4.19 00/93] 4.19.81-stable review kernelci.org bot
2019-10-28 9:01 ` Didik Setiawan
2019-10-28 14:52 ` Guenter Roeck
2019-10-28 21:47 ` Jon Hunter
2019-10-29 6:21 ` Naresh Kamboju
2019-10-29 8:20 ` Greg Kroah-Hartman
2019-10-29 16:24 ` Pavel Machek
2019-10-29 18:02 ` Greg Kroah-Hartman
2019-11-06 18:59 ` Pavel Machek
2019-11-06 20:18 ` Greg Kroah-Hartman
2019-11-07 16:43 ` Ben Hutchings
2019-11-08 21:31 ` Pavel Machek
2019-11-09 15:53 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191027203302.306603006@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=john.garry@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael.j.wysocki@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).