archive mirror
 help / color / mirror / Atom feed
From: "Uwe Kleine-König" <>
To: Nishanth Menon <>, Tero Kristo <>,
	Santosh Shilimkar <>
	Greg Kroah-Hartman <>
Subject: firmware: ti_sci: resource leak and use after free
Date: Thu, 16 Feb 2023 09:39:08 +0100	[thread overview]
Message-ID: <> (raw)

[-- Attachment #1.1: Type: text/plain, Size: 1142 bytes --]


The ti_sci firmware driver (drivers/firmware/ti_sci.c) has a problem in
its remove callback. I didn't check it to an end and I also don't have
the needed hardware available to test, so take my diagnosis with a grain
of salt.

The problem is that if ti_sci_remove() is called while info->users is
non-zero it skips ti_sci_debugfs_destroy() and mbox_free_channel(),
however the device will be unbound after ti_sci_remove() completes and
(among other stuff) *info will be freed. (See platform_remove() in
drivers/base/platform.c.) However the debugfs entries stay available and
accessing them will access *info. Also info stays linked in ti_sci_list
and might be traversed there. Maybe similar problems can happen with the
unfreed mbox channels.

Fixing that requires (at least) that info stays around until it's
completely unreferenced. I don't know enough about the firmware
framework and the involved hardware to suggest a fix though.

Best regards

Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | |

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 176 bytes --]

linux-arm-kernel mailing list

                 reply	other threads:[~2023-02-16  8:40 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).