* [PATCH v4 1/2] clk: fix invalid usage of list cursor in register
@ 2021-04-01 22:51 Lukasz Bartosik
2021-04-01 22:51 ` [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister Lukasz Bartosik
2021-04-03 6:56 ` [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Stephen Boyd
0 siblings, 2 replies; 4+ messages in thread
From: Lukasz Bartosik @ 2021-04-01 22:51 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd; +Cc: linux-clk, upstream
Fix invalid usage of a list_for_each_entry cursor in
clk_notifier_register(). When list is empty or if the list
is completely traversed (without breaking from the loop on one
of the entries) then the list cursor does not point to a valid
entry and therefore should not be used.
The issue was dicovered when running 5.12-rc1 kernel on x86_64
with KASAN enabled:
BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
Hardware name: Google Caroline/Caroline,
BIOS Google_Caroline.7820.430.0 07/20/2018
Call Trace:
dump_stack+0xee/0x15c
print_address_description+0x1e/0x2dc
kasan_report+0x188/0x1ce
? clk_notifier_register+0xab/0x230
? clk_prepare_lock+0x15/0x7b
? clk_notifier_register+0xab/0x230
clk_notifier_register+0xab/0x230
dw8250_probe+0xc01/0x10d4
...
Memory state around the buggy address:
ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
>ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
^
ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
==================================================================
Fixes: b2476490ef11 ("clk: introduce the common clock framework")
Reported-by: Lukasz Majczak <lma@semihalf.com>
Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
---
drivers/clk/clk.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index d181c6d31d22..ba9252591f44 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4345,20 +4345,19 @@ int clk_notifier_register(struct clk *clk, struct notifier_block *nb)
/* search the list of notifiers for this clk */
list_for_each_entry(cn, &clk_notifier_list, node)
if (cn->clk == clk)
- break;
+ goto found;
/* if clk wasn't in the notifier list, allocate new clk_notifier */
- if (cn->clk != clk) {
- cn = kzalloc(sizeof(*cn), GFP_KERNEL);
- if (!cn)
- goto out;
+ cn = kzalloc(sizeof(*cn), GFP_KERNEL);
+ if (!cn)
+ goto out;
- cn->clk = clk;
- srcu_init_notifier_head(&cn->notifier_head);
+ cn->clk = clk;
+ srcu_init_notifier_head(&cn->notifier_head);
- list_add(&cn->node, &clk_notifier_list);
- }
+ list_add(&cn->node, &clk_notifier_list);
+found:
ret = srcu_notifier_chain_register(&cn->notifier_head, nb);
clk->core->notifier_count++;
--
2.31.0.208.g409f899ff0-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister
2021-04-01 22:51 [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Lukasz Bartosik
@ 2021-04-01 22:51 ` Lukasz Bartosik
2021-04-03 6:56 ` Stephen Boyd
2021-04-03 6:56 ` [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Stephen Boyd
1 sibling, 1 reply; 4+ messages in thread
From: Lukasz Bartosik @ 2021-04-01 22:51 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd; +Cc: linux-clk, upstream
Fix invalid usage of a list_for_each_entry cursor in
clk_notifier_unregister(). When list is empty or if the list
is completely traversed (without breaking from the loop on one
of the entries) then the list cursor does not point to a valid
entry and therefore should not be used. The patch fixes a logical
bug that hasn't been seen in pratice however it is analogus
to the bug fixed in clk_notifier_register().
The issue was dicovered when running 5.12-rc1 kernel on x86_64
with KASAN enabled:
BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
Hardware name: Google Caroline/Caroline,
BIOS Google_Caroline.7820.430.0 07/20/2018
Call Trace:
dump_stack+0xee/0x15c
print_address_description+0x1e/0x2dc
kasan_report+0x188/0x1ce
? clk_notifier_register+0xab/0x230
? clk_prepare_lock+0x15/0x7b
? clk_notifier_register+0xab/0x230
clk_notifier_register+0xab/0x230
dw8250_probe+0xc01/0x10d4
...
Memory state around the buggy address:
ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
>ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
^
ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
==================================================================
Fixes: b2476490ef11 ("clk: introduce the common clock framework")
Reported-by: Lukasz Majczak <lma@semihalf.com>
Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
---
drivers/clk/clk.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index ba9252591f44..d6301a3351f2 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -4382,32 +4382,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
*/
int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
{
- struct clk_notifier *cn = NULL;
- int ret = -EINVAL;
+ struct clk_notifier *cn;
+ int ret = -ENOENT;
if (!clk || !nb)
return -EINVAL;
clk_prepare_lock();
- list_for_each_entry(cn, &clk_notifier_list, node)
- if (cn->clk == clk)
- break;
-
- if (cn->clk == clk) {
- ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+ list_for_each_entry(cn, &clk_notifier_list, node) {
+ if (cn->clk == clk) {
+ ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
- clk->core->notifier_count--;
+ clk->core->notifier_count--;
- /* XXX the notifier code should handle this better */
- if (!cn->notifier_head.head) {
- srcu_cleanup_notifier_head(&cn->notifier_head);
- list_del(&cn->node);
- kfree(cn);
+ /* XXX the notifier code should handle this better */
+ if (!cn->notifier_head.head) {
+ srcu_cleanup_notifier_head(&cn->notifier_head);
+ list_del(&cn->node);
+ kfree(cn);
+ }
+ break;
}
-
- } else {
- ret = -ENOENT;
}
clk_prepare_unlock();
--
2.31.0.208.g409f899ff0-goog
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v4 1/2] clk: fix invalid usage of list cursor in register
2021-04-01 22:51 [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Lukasz Bartosik
2021-04-01 22:51 ` [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister Lukasz Bartosik
@ 2021-04-03 6:56 ` Stephen Boyd
1 sibling, 0 replies; 4+ messages in thread
From: Stephen Boyd @ 2021-04-03 6:56 UTC (permalink / raw)
To: Lukasz Bartosik, Michael Turquette; +Cc: linux-clk, upstream
Quoting Lukasz Bartosik (2021-04-01 15:51:48)
> Fix invalid usage of a list_for_each_entry cursor in
> clk_notifier_register(). When list is empty or if the list
> is completely traversed (without breaking from the loop on one
> of the entries) then the list cursor does not point to a valid
> entry and therefore should not be used.
>
> The issue was dicovered when running 5.12-rc1 kernel on x86_64
> with KASAN enabled:
> BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
> Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
>
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
> Hardware name: Google Caroline/Caroline,
> BIOS Google_Caroline.7820.430.0 07/20/2018
> Call Trace:
> dump_stack+0xee/0x15c
> print_address_description+0x1e/0x2dc
> kasan_report+0x188/0x1ce
> ? clk_notifier_register+0xab/0x230
> ? clk_prepare_lock+0x15/0x7b
> ? clk_notifier_register+0xab/0x230
> clk_notifier_register+0xab/0x230
> dw8250_probe+0xc01/0x10d4
> ...
> Memory state around the buggy address:
> ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
> ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
> >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
> ^
> ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
> ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
> ==================================================================
>
> Fixes: b2476490ef11 ("clk: introduce the common clock framework")
> Reported-by: Lukasz Majczak <lma@semihalf.com>
> Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
> ---
Applied to clk-fixes
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister
2021-04-01 22:51 ` [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister Lukasz Bartosik
@ 2021-04-03 6:56 ` Stephen Boyd
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Boyd @ 2021-04-03 6:56 UTC (permalink / raw)
To: Lukasz Bartosik, Michael Turquette; +Cc: linux-clk, upstream
Quoting Lukasz Bartosik (2021-04-01 15:51:49)
> Fix invalid usage of a list_for_each_entry cursor in
> clk_notifier_unregister(). When list is empty or if the list
> is completely traversed (without breaking from the loop on one
> of the entries) then the list cursor does not point to a valid
> entry and therefore should not be used. The patch fixes a logical
> bug that hasn't been seen in pratice however it is analogus
> to the bug fixed in clk_notifier_register().
>
> The issue was dicovered when running 5.12-rc1 kernel on x86_64
> with KASAN enabled:
> BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
> Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
>
> CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
> Hardware name: Google Caroline/Caroline,
> BIOS Google_Caroline.7820.430.0 07/20/2018
> Call Trace:
> dump_stack+0xee/0x15c
> print_address_description+0x1e/0x2dc
> kasan_report+0x188/0x1ce
> ? clk_notifier_register+0xab/0x230
> ? clk_prepare_lock+0x15/0x7b
> ? clk_notifier_register+0xab/0x230
> clk_notifier_register+0xab/0x230
> dw8250_probe+0xc01/0x10d4
> ...
> Memory state around the buggy address:
> ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
> ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
> >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
> ^
> ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
> ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
> ==================================================================
>
> Fixes: b2476490ef11 ("clk: introduce the common clock framework")
> Reported-by: Lukasz Majczak <lma@semihalf.com>
> Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
> ---
Applied to clk-fixes
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-04-03 6:56 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-01 22:51 [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Lukasz Bartosik
2021-04-01 22:51 ` [PATCH v4 2/2] clk: fix invalid usage of list cursor in unregister Lukasz Bartosik
2021-04-03 6:56 ` Stephen Boyd
2021-04-03 6:56 ` [PATCH v4 1/2] clk: fix invalid usage of list cursor in register Stephen Boyd
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).