* [PATCH] cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
@ 2021-09-14 16:56 James Morse
2021-09-14 17:08 ` Rafael J. Wysocki
0 siblings, 1 reply; 2+ messages in thread
From: James Morse @ 2021-09-14 16:56 UTC (permalink / raw)
To: linux-kernel, linux-pm
Cc: rafael, haokexin, juri.lelli, mingo, peterz, vincent.guittot,
viresh.kumar, james.morse
Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
method to free sugov_tunables") kobject_put() has kfree()d the
attr_set before gov_attr_set_put() returns.
kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
the subsequent mutex_destroy() triggers a use-after-free:
| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
| Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
|
| CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
| Platform, BIOS EDK II Jul 30 2018
| Call trace:
| dump_backtrace+0x0/0x380
| show_stack+0x1c/0x30
| dump_stack_lvl+0x8c/0xb8
| print_address_description.constprop.0+0x74/0x2b8
| kasan_report+0x1f4/0x210
| kasan_check_range+0xfc/0x1a4
| __kasan_check_read+0x38/0x60
| mutex_is_locked+0x20/0x60
| mutex_destroy+0x80/0x100
| gov_attr_set_put+0xfc/0x150
| sugov_exit+0x78/0x190
| cpufreq_offline.isra.0+0x2c0/0x660
| cpuhp_cpufreq_offline+0x14/0x24
| cpuhp_invoke_callback+0x430/0x6d0
| cpuhp_thread_fun+0x1b0/0x624
| smpboot_thread_fn+0x5e0/0xa6c
| kthread+0x3a0/0x450
| ret_from_fork+0x10/0x20
Swap the order of the calls.
Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
CC: Kevin Hao <haokexin@gmail.com>
CC: Viresh Kumar <viresh.kumar@linaro.org>
CC: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: James Morse <james.morse@arm.com>
---
drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
index 66b05a326910..a6f365b9cc1a 100644
--- a/drivers/cpufreq/cpufreq_governor_attr_set.c
+++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
if (count)
return count;
- kobject_put(&attr_set->kobj);
mutex_destroy(&attr_set->update_lock);
+ kobject_put(&attr_set->kobj);
return 0;
}
EXPORT_SYMBOL_GPL(gov_attr_set_put);
--
2.30.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
2021-09-14 16:56 [PATCH] cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory James Morse
@ 2021-09-14 17:08 ` Rafael J. Wysocki
0 siblings, 0 replies; 2+ messages in thread
From: Rafael J. Wysocki @ 2021-09-14 17:08 UTC (permalink / raw)
To: James Morse
Cc: Linux Kernel Mailing List, Linux PM, Rafael J. Wysocki,
Kevin Hao, Juri Lelli, Ingo Molnar, Peter Zijlstra,
Vincent Guittot, Viresh Kumar
On Tue, Sep 14, 2021 at 6:56 PM James Morse <james.morse@arm.com> wrote:
>
> Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release()
> method to free sugov_tunables") kobject_put() has kfree()d the
> attr_set before gov_attr_set_put() returns.
>
> kobject_put() isn't the last user of attr_set in gov_attr_set_put(),
> the subsequent mutex_destroy() triggers a use-after-free:
> | BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60
> | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20
> |
> | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369
> | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development
> | Platform, BIOS EDK II Jul 30 2018
> | Call trace:
> | dump_backtrace+0x0/0x380
> | show_stack+0x1c/0x30
> | dump_stack_lvl+0x8c/0xb8
> | print_address_description.constprop.0+0x74/0x2b8
> | kasan_report+0x1f4/0x210
> | kasan_check_range+0xfc/0x1a4
> | __kasan_check_read+0x38/0x60
> | mutex_is_locked+0x20/0x60
> | mutex_destroy+0x80/0x100
> | gov_attr_set_put+0xfc/0x150
> | sugov_exit+0x78/0x190
> | cpufreq_offline.isra.0+0x2c0/0x660
> | cpuhp_cpufreq_offline+0x14/0x24
> | cpuhp_invoke_callback+0x430/0x6d0
> | cpuhp_thread_fun+0x1b0/0x624
> | smpboot_thread_fn+0x5e0/0xa6c
> | kthread+0x3a0/0x450
> | ret_from_fork+0x10/0x20
>
> Swap the order of the calls.
>
> Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
> Cc: 4.7+ <stable@vger.kernel.org> # 4.7+
> CC: Kevin Hao <haokexin@gmail.com>
> CC: Viresh Kumar <viresh.kumar@linaro.org>
> CC: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> Signed-off-by: James Morse <james.morse@arm.com>
> ---
> drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
> index 66b05a326910..a6f365b9cc1a 100644
> --- a/drivers/cpufreq/cpufreq_governor_attr_set.c
> +++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
> @@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
> if (count)
> return count;
>
> - kobject_put(&attr_set->kobj);
> mutex_destroy(&attr_set->update_lock);
> + kobject_put(&attr_set->kobj);
Doh
I should have caught this one, thanks!
> return 0;
> }
> EXPORT_SYMBOL_GPL(gov_attr_set_put);
> --
Applied as 5.15-rc material, thanks!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-09-14 17:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-14 16:56 [PATCH] cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory James Morse
2021-09-14 17:08 ` Rafael J. Wysocki
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.