From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Vincent Whitchurch <vincent.whitchurch@axis.com>,
Alexandre Belloni <alexandre.belloni@bootlin.com>,
Sasha Levin <sashal@kernel.org>,
a.zummo@towertech.it, linux-rtc@vger.kernel.org
Subject: [PATCH AUTOSEL 5.15 02/27] rtc: fix use-after-free on device removal
Date: Wed, 6 Apr 2022 21:12:32 -0400 [thread overview]
Message-ID: <20220407011257.114287-2-sashal@kernel.org> (raw)
In-Reply-To: <20220407011257.114287-1-sashal@kernel.org>
From: Vincent Whitchurch <vincent.whitchurch@axis.com>
[ Upstream commit c8fa17d9f08a448184f03d352145099b5beb618e ]
If the irqwork is still scheduled or running while the RTC device is
removed, a use-after-free occurs in rtc_timer_do_work(). Cleanup the
timerqueue and ensure the work is stopped to fix this.
BUG: KASAN: use-after-free in mutex_lock+0x94/0x110
Write of size 8 at addr ffffff801d846338 by task kworker/3:1/41
Workqueue: events rtc_timer_do_work
Call trace:
mutex_lock+0x94/0x110
rtc_timer_do_work+0xec/0x630
process_one_work+0x5fc/0x1344
...
Allocated by task 551:
kmem_cache_alloc_trace+0x384/0x6e0
devm_rtc_allocate_device+0xf0/0x574
devm_rtc_device_register+0x2c/0x12c
...
Freed by task 572:
kfree+0x114/0x4d0
rtc_device_release+0x64/0x80
device_release+0x8c/0x1f4
kobject_put+0x1c4/0x4b0
put_device+0x20/0x30
devm_rtc_release_device+0x1c/0x30
devm_action_release+0x54/0x90
release_nodes+0x124/0x310
devres_release_group+0x170/0x240
i2c_device_remove+0xd8/0x314
...
Last potentially related work creation:
insert_work+0x5c/0x330
queue_work_on+0xcc/0x154
rtc_set_time+0x188/0x5bc
rtc_dev_ioctl+0x2ac/0xbd0
...
Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/20211210160951.7718-1-vincent.whitchurch@axis.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/class.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index f77bc089eb6b..0aef7df2ea70 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -26,6 +26,15 @@ struct class *rtc_class;
static void rtc_device_release(struct device *dev)
{
struct rtc_device *rtc = to_rtc_device(dev);
+ struct timerqueue_head *head = &rtc->timerqueue;
+ struct timerqueue_node *node;
+
+ mutex_lock(&rtc->ops_lock);
+ while ((node = timerqueue_getnext(head)))
+ timerqueue_del(head, node);
+ mutex_unlock(&rtc->ops_lock);
+
+ cancel_work_sync(&rtc->irqwork);
ida_simple_remove(&rtc_ida, rtc->id);
mutex_destroy(&rtc->ops_lock);
--
2.35.1
next prev parent reply other threads:[~2022-04-07 1:31 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-07 1:12 [PATCH AUTOSEL 5.15 01/27] gfs2: assign rgrp glock before compute_bitstructs Sasha Levin
2022-04-07 1:12 ` [Cluster-devel] " Sasha Levin
2022-04-07 1:12 ` Sasha Levin [this message]
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 03/27] rtc: pcf2127: fix bug when reading alarm registers Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 04/27] um: Cleanup syscall_handler_t definition/cast, fix warning Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 05/27] um: port_user: Improve error handling when port-helper is not found Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 06/27] Input: add bounds checking to input_set_capability() Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 07/27] Input: stmfts - fix reference leak in stmfts_input_open Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 08/27] nvme-pci: add quirks for Samsung X5 SSDs Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 09/27] gfs2: Disable page faults during lockless buffered reads Sasha Levin
2022-04-07 1:12 ` [Cluster-devel] " Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 10/27] rtc: sun6i: Fix time overflow handling Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 11/27] crypto: stm32 - fix reference leak in stm32_crc_remove Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 12/27] crypto: x86/chacha20 - Avoid spurious jumps to other functions Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 13/27] ALSA: hda/realtek: Enable headset mic on Lenovo P360 Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 14/27] s390/traps: improve panic message for translation-specification exception Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 15/27] s390/pci: improve zpci_dev reference counting Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 16/27] vhost_vdpa: don't setup irq offloading when irq_num < 0 Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 17/27] tools/virtio: compile with -pthread Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 18/27] nvmet: use a private workqueue instead of the system workqueue Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 19/27] nvme-multipath: fix hang when disk goes live over reconnect Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 20/27] rtc: mc146818-lib: Fix the AltCentury for AMD platforms Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 21/27] fs: fix an infinite loop in iomap_fiemap Sasha Levin
2022-04-07 11:28 ` Amir Goldstein
2022-04-07 11:30 ` Amir Goldstein
2022-05-17 17:33 ` Amir Goldstein
2022-05-18 12:24 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 22/27] MIPS: lantiq: check the return value of kzalloc() Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 23/27] drbd: remove usage of list iterator variable after loop Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 24/27] platform/chrome: cros_ec_debugfs: detach log reader wq from devm Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 25/27] ARM: 9191/1: arm/stacktrace, kasan: Silence KASAN warnings in unwind_frame() Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 26/27] nilfs2: fix lockdep warnings in page operations for btree nodes Sasha Levin
2022-04-07 1:12 ` Sasha Levin
2022-04-07 1:12 ` [PATCH AUTOSEL 5.15 27/27] nilfs2: fix lockdep warnings during disk space reclamation Sasha Levin
2022-04-07 1:12 ` Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220407011257.114287-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=a.zummo@towertech.it \
--cc=alexandre.belloni@bootlin.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rtc@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=vincent.whitchurch@axis.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.