From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
To: andersson@kernel.org, robh+dt@kernel.org,
krzysztof.kozlowski+dt@linaro.org, bp@alien8.de,
tony.luck@intel.com
Cc: quic_saipraka@quicinc.com, konrad.dybcio@linaro.org,
linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
james.morse@arm.com, mchehab@kernel.org, rric@kernel.org,
linux-edac@vger.kernel.org, quic_ppareek@quicinc.com,
luca.weiss@fairphone.com, ahalaney@redhat.com, steev@kali.org,
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>,
stable@vger.kernel.org
Subject: [PATCH v4 14/16] EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
Date: Thu, 22 Dec 2022 18:46:54 +0530 [thread overview]
Message-ID: <20221222131656.49584-15-manivannan.sadhasivam@linaro.org> (raw)
In-Reply-To: <20221222131656.49584-1-manivannan.sadhasivam@linaro.org>
The memory for "llcc_driv_data" is allocated by the LLCC driver. But when
it is passed as "pvt_info" to the EDAC core, it will get freed during the
qcom_edac driver release. So when the qcom_edac driver gets probed again,
it will try to use the freed data leading to the use-after-free bug.
Fix this by not passing "llcc_driv_data" as pvt_info but rather reference
it using the "platform_data" in the qcom_edac driver.
Cc: <stable@vger.kernel.org> # 4.20
Fixes: 27450653f1db ("drivers: edac: Add EDAC driver support for QCOM SoCs")
Reported-by: Steev Klimaszewski <steev@kali.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
---
drivers/edac/qcom_edac.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/qcom_edac.c b/drivers/edac/qcom_edac.c
index 9e77fa84e84f..3256254c3722 100644
--- a/drivers/edac/qcom_edac.c
+++ b/drivers/edac/qcom_edac.c
@@ -252,7 +252,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type)
static int
dump_syn_reg(struct edac_device_ctl_info *edev_ctl, int err_type, u32 bank)
{
- struct llcc_drv_data *drv = edev_ctl->pvt_info;
+ struct llcc_drv_data *drv = edev_ctl->dev->platform_data;
int ret;
ret = dump_syn_reg_values(drv, bank, err_type);
@@ -289,7 +289,7 @@ static irqreturn_t
llcc_ecc_irq_handler(int irq, void *edev_ctl)
{
struct edac_device_ctl_info *edac_dev_ctl = edev_ctl;
- struct llcc_drv_data *drv = edac_dev_ctl->pvt_info;
+ struct llcc_drv_data *drv = edac_dev_ctl->dev->platform_data;
irqreturn_t irq_rc = IRQ_NONE;
u32 drp_error, trp_error, i;
int ret;
@@ -358,7 +358,6 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev)
edev_ctl->dev_name = dev_name(dev);
edev_ctl->ctl_name = "llcc";
edev_ctl->panic_on_ue = LLCC_ERP_PANIC_ON_UE;
- edev_ctl->pvt_info = llcc_driv_data;
rc = edac_device_add_device(edev_ctl);
if (rc)
--
2.25.1
next prev parent reply other threads:[~2022-12-22 13:20 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-22 13:16 [PATCH v4 00/16] Qcom: LLCC/EDAC: Fix base address used for LLCC banks Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 01/16] dt-bindings: arm: msm: Update the maintainers for LLCC Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 02/16] dt-bindings: arm: msm: Fix register regions used for LLCC banks Manivannan Sadhasivam
2022-12-23 8:58 ` Krzysztof Kozlowski
2022-12-22 13:16 ` [PATCH v4 03/16] arm64: dts: qcom: sdm845: Fix the base addresses of " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 04/16] arm64: dts: qcom: sc7180: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 05/16] arm64: dts: qcom: sc7280: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 06/16] arm64: dts: qcom: sc8280xp: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 07/16] arm64: dts: qcom: sm8150: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 08/16] arm64: dts: qcom: sm8250: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 09/16] arm64: dts: qcom: sm8350: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 10/16] arm64: dts: qcom: sm8450: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 11/16] arm64: dts: qcom: sm6350: " Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 12/16] EDAC/device: Make use of poll_msec value in edac_device_ctl_info struct Manivannan Sadhasivam
2022-12-22 13:16 ` [PATCH v4 13/16] EDAC/qcom: Add platform_device_id table for module autoloading Manivannan Sadhasivam
2022-12-22 13:16 ` Manivannan Sadhasivam [this message]
2022-12-22 13:16 ` [PATCH v4 15/16] qcom: llcc/edac: Fix the base address used for accessing LLCC banks Manivannan Sadhasivam
2022-12-28 4:29 ` Bjorn Andersson
2022-12-28 6:53 ` Manivannan Sadhasivam
2022-12-28 9:43 ` Krzysztof Kozlowski
2022-12-22 13:16 ` [PATCH v4 16/16] qcom: llcc/edac: Support polling mode for ECC handling Manivannan Sadhasivam
2022-12-22 14:28 ` [PATCH v4 00/16] Qcom: LLCC/EDAC: Fix base address used for LLCC banks Andrew Halaney
2022-12-23 3:43 ` Steev Klimaszewski
2022-12-28 4:31 ` Bjorn Andersson
2022-12-28 6:50 ` Manivannan Sadhasivam
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221222131656.49584-15-manivannan.sadhasivam@linaro.org \
--to=manivannan.sadhasivam@linaro.org \
--cc=ahalaney@redhat.com \
--cc=andersson@kernel.org \
--cc=bp@alien8.de \
--cc=james.morse@arm.com \
--cc=konrad.dybcio@linaro.org \
--cc=krzysztof.kozlowski+dt@linaro.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-edac@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luca.weiss@fairphone.com \
--cc=mchehab@kernel.org \
--cc=quic_ppareek@quicinc.com \
--cc=quic_saipraka@quicinc.com \
--cc=robh+dt@kernel.org \
--cc=rric@kernel.org \
--cc=stable@vger.kernel.org \
--cc=steev@kali.org \
--cc=tony.luck@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).