From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Guillaume Ranquet <granquet@baylibre.com>,
Vinod Koul <vkoul@kernel.org>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 18/71] dmaengine: mediatek: free the proper desc in desc_free handler
Date: Mon, 28 Jun 2021 10:29:11 -0400 [thread overview]
Message-ID: <20210628143004.32596-19-sashal@kernel.org> (raw)
In-Reply-To: <20210628143004.32596-1-sashal@kernel.org>
From: Guillaume Ranquet <granquet@baylibre.com>
[ Upstream commit 0a2ff58f9f8f95526ecb0ccd7517fefceb96f661 ]
The desc_free handler assumed that the desc we want to free was always
the current one associated with the channel.
This is seldom the case and this is causing use after free crashes in
multiple places (tx/rx/terminate...).
BUG: KASAN: use-after-free in mtk_uart_apdma_rx_handler+0x120/0x304
Call trace:
dump_backtrace+0x0/0x1b0
show_stack+0x24/0x34
dump_stack+0xe0/0x150
print_address_description+0x8c/0x55c
__kasan_report+0x1b8/0x218
kasan_report+0x14/0x20
__asan_load4+0x98/0x9c
mtk_uart_apdma_rx_handler+0x120/0x304
mtk_uart_apdma_irq_handler+0x50/0x80
__handle_irq_event_percpu+0xe0/0x210
handle_irq_event+0x8c/0x184
handle_fasteoi_irq+0x1d8/0x3ac
__handle_domain_irq+0xb0/0x110
gic_handle_irq+0x50/0xb8
el0_irq_naked+0x60/0x6c
Allocated by task 3541:
__kasan_kmalloc+0xf0/0x1b0
kasan_kmalloc+0x10/0x1c
kmem_cache_alloc_trace+0x90/0x2dc
mtk_uart_apdma_prep_slave_sg+0x6c/0x1a0
mtk8250_dma_rx_complete+0x220/0x2e4
vchan_complete+0x290/0x340
tasklet_action_common+0x220/0x298
tasklet_action+0x28/0x34
__do_softirq+0x158/0x35c
Freed by task 3541:
__kasan_slab_free+0x154/0x224
kasan_slab_free+0x14/0x24
slab_free_freelist_hook+0xf8/0x15c
kfree+0xb4/0x278
mtk_uart_apdma_desc_free+0x34/0x44
vchan_complete+0x1bc/0x340
tasklet_action_common+0x220/0x298
tasklet_action+0x28/0x34
__do_softirq+0x158/0x35c
The buggy address belongs to the object at ffff000063606800
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 176 bytes inside of
256-byte region [ffff000063606800, ffff000063606900)
The buggy address belongs to the page:
page:fffffe00016d8180 refcount:1 mapcount:0 mapping:ffff00000302f600 index:0x0 compound_mapcount: 0
flags: 0xffff00000010200(slab|head)
raw: 0ffff00000010200 dead000000000100 dead000000000122 ffff00000302f600
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Signed-off-by: Guillaume Ranquet <granquet@baylibre.com>
Link: https://lore.kernel.org/r/20210513192642.29446-2-granquet@baylibre.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/mediatek/mtk-uart-apdma.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index f40051d6aecb..311d7c236d27 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -131,10 +131,7 @@ static unsigned int mtk_uart_apdma_read(struct mtk_chan *c, unsigned int reg)
static void mtk_uart_apdma_desc_free(struct virt_dma_desc *vd)
{
- struct dma_chan *chan = vd->tx.chan;
- struct mtk_chan *c = to_mtk_uart_apdma_chan(chan);
-
- kfree(c->desc);
+ kfree(container_of(vd, struct mtk_uart_apdma_desc, vd));
}
static void mtk_uart_apdma_start_tx(struct mtk_chan *c)
--
2.30.2
next prev parent reply other threads:[~2021-06-28 14:45 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-28 14:28 [PATCH 5.4 00/71] 5.4.129-rc1 review Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 01/71] module: limit enabling module.sig_enforce Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 02/71] Revert "drm/amdgpu/gfx9: fix the doorbell missing when in CGPG issue." Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 03/71] Revert "drm/amdgpu/gfx10: enlarge CP_MEC_DOORBELL_RANGE_UPPER to cover full doorbell." Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 04/71] drm/nouveau: wait for moving fence after pinning v2 Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 05/71] drm/radeon: wait for moving fence after pinning Sasha Levin
2021-06-28 14:28 ` [PATCH 5.4 06/71] ARM: 9081/1: fix gcc-10 thumb2-kernel regression Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 07/71] mmc: meson-gx: use memcpy_to/fromio for dram-access-quirk Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 08/71] kbuild: add CONFIG_LD_IS_LLD Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 09/71] arm64: link with -z norelro for LLD or aarch64-elf Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 10/71] MIPS: generic: Update node names to avoid unit addresses Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 11/71] spi: spi-nxp-fspi: move the register operation after the clock enable Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 12/71] Revert "PCI: PM: Do not read power state in pci_enable_device_flags()" Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 13/71] dmaengine: zynqmp_dma: Fix PM reference leak in zynqmp_dma_alloc_chan_resourc() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 14/71] mac80211: remove warning in ieee80211_get_sband() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 15/71] mac80211_hwsim: drop pending frames on stop Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 16/71] cfg80211: call cfg80211_leave_ocb when switching away from OCB Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 17/71] dmaengine: rcar-dmac: Fix PM reference leak in rcar_dmac_probe() Sasha Levin
2021-06-28 14:29 ` Sasha Levin [this message]
2021-06-28 14:29 ` [PATCH 5.4 19/71] dmaengine: mediatek: do not issue a new desc if one is still current Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 20/71] dmaengine: mediatek: use GFP_NOWAIT instead of GFP_ATOMIC in prep_dma Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 21/71] net: ipv4: Remove unneed BUG() function Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 22/71] mac80211: drop multicast fragments Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 23/71] net: ethtool: clear heap allocations for ethtool function Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 24/71] ping: Check return value of function 'ping_queue_rcv_skb' Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 25/71] inet: annotate date races around sk->sk_txhash Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 26/71] net: phy: dp83867: perform soft reset and retain established link Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 27/71] net: caif: fix memory leak in ldisc_open Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 28/71] net/packet: annotate accesses to po->bind Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 29/71] net/packet: annotate accesses to po->ifindex Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 30/71] r8152: Avoid memcpy() over-reading of ETH_SS_STATS Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 31/71] sh_eth: " Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 32/71] r8169: " Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 33/71] KVM: selftests: Fix kvm_check_cap() assertion Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 34/71] net: qed: Fix memcpy() overflow of qed_dcbx_params() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 35/71] recordmcount: Correct st_shndx handling Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 36/71] PCI: Add AMD RS690 quirk to enable 64-bit DMA Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 37/71] net: ll_temac: Add memory-barriers for TX BD access Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 38/71] net: ll_temac: Avoid ndo_start_xmit returning NETDEV_TX_BUSY Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 39/71] pinctrl: stm32: fix the reported number of GPIO lines per bank Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 40/71] nilfs2: fix memory leak in nilfs_sysfs_delete_device_group Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 41/71] KVM: do not allow mapping valid but non-reference-counted pages Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 42/71] i2c: robotfuzz-osif: fix control-request directions Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 43/71] kthread_worker: split code for canceling the delayed work timer Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 44/71] kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 45/71] mm: add VM_WARN_ON_ONCE_PAGE() macro Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 46/71] mm/rmap: remove unneeded semicolon in page_not_mapped() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 47/71] mm/rmap: use page_not_mapped in try_to_unmap() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 48/71] mm, thp: use head page in __migration_entry_wait() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 49/71] mm/thp: fix __split_huge_pmd_locked() on shmem migration entry Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 50/71] mm/thp: make is_huge_zero_pmd() safe and quicker Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 51/71] mm/thp: try_to_unmap() use TTU_SYNC for safe splitting Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 52/71] mm/thp: fix vma_address() if virtual address below file offset Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 53/71] mm/thp: fix page_address_in_vma() on file THP tails Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 54/71] mm/thp: unmap_mapping_page() to fix THP truncate_cleanup_page() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 55/71] mm: thp: replace DEBUG_VM BUG with VM_WARN when unmap fails for split Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 56/71] mm: page_vma_mapped_walk(): use page for pvmw->page Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 57/71] mm: page_vma_mapped_walk(): settle PageHuge on entry Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 58/71] mm: page_vma_mapped_walk(): use pmde for *pvmw->pmd Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 59/71] mm: page_vma_mapped_walk(): prettify PVMW_MIGRATION block Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 60/71] mm: page_vma_mapped_walk(): crossing page table boundary Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 61/71] mm: page_vma_mapped_walk(): add a level of indentation Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 62/71] mm: page_vma_mapped_walk(): use goto instead of while (1) Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 63/71] mm: page_vma_mapped_walk(): get vma_address_end() earlier Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 64/71] mm/thp: fix page_vma_mapped_walk() if THP mapped by ptes Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 65/71] mm/thp: another PVMW_SYNC fix in page_vma_mapped_walk() Sasha Levin
2021-06-28 14:29 ` [PATCH 5.4 66/71] mm, futex: fix shared futex pgoff on shmem huge page Sasha Levin
2021-06-28 14:30 ` [PATCH 5.4 67/71] certs: Add wrapper function to check blacklisted binary hash Sasha Levin
2021-06-28 14:30 ` [PATCH 5.4 68/71] x86/efi: move common keyring handler functions to new file Sasha Levin
2021-06-28 14:30 ` [PATCH 5.4 69/71] certs: Add EFI_CERT_X509_GUID support for dbx entries Sasha Levin
2021-06-28 14:30 ` [PATCH 5.4 70/71] certs: Move load_system_certificate_list to a common function Sasha Levin
2021-06-28 14:30 ` [PATCH 5.4 71/71] Linux 5.4.129-rc1 Sasha Levin
2021-06-28 20:57 ` [PATCH 5.4 00/71] 5.4.129-rc1 review Shuah Khan
2021-06-28 21:20 ` Sasha Levin
2021-06-29 6:11 ` Greg Kroah-Hartman
2021-06-29 6:11 ` Greg Kroah-Hartman
2021-06-29 14:00 ` Shuah Khan
2021-06-29 6:24 ` Samuel Zou
2021-06-29 8:39 ` Naresh Kamboju
2021-06-29 10:21 ` Jon Hunter
2021-06-29 12:05 ` Sudip Mukherjee
2021-06-29 18:20 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210628143004.32596-19-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=granquet@baylibre.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vkoul@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.