From: Randy Dunlap <rdunlap@infradead.org>
To: Brendan Higgins <brendanhiggins@google.com>,
gregkh@linuxfoundation.org, rafael@kernel.org
Cc: linux-kernel@vger.kernel.org, naresh.kamboju@linaro.org,
sakari.ailus@linux.intel.com, andy.shevchenko@gmail.com,
hdegoede@redhat.com, rafael.j.wysocki@intel.com,
linux-kselftest@vger.kernel.org, rostedt@goodmis.org,
sergey.senozhatsky@gmail.com, andriy.shevchenko@linux.intel.com,
shuah@kernel.org, anders.roxell@linaro.org,
lkft-triage@lists.linaro.org, linux@rasmusvillemoes.dk,
Heikki Krogerus <heikki.krogerus@linux.intel.com>
Subject: Re: [PATCH v1] kobject: make sure parent is not released before children
Date: Tue, 14 Apr 2020 15:38:46 -0700 [thread overview]
Message-ID: <71775e76-6175-d64b-0f4e-1beeb6b589b3@infradead.org> (raw)
In-Reply-To: <20200414204240.186377-1-brendanhiggins@google.com>
On 4/14/20 1:42 PM, Brendan Higgins wrote:
> From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>
> Previously, kobjects were released before the associated kobj_types;
> this can cause a kobject deallocation to fail when the kobject has
> children; an example of this is in software_node_unregister_nodes(); it
> calls release on the parent before children meaning that children can be
> released after the parent, which may be needed for removal.
>
> So, take a reference to the parent before we delete a node to ensure
> that the parent is not released before the children.
>
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> Fixes: 7589238a8cf3 ("Revert "software node: Simplify software_node_release() function"")
> Link: https://lore.kernel.org/linux-kselftest/CAFd5g44s5NQvT8TG_x4rwbqoa7zWzkV0TX+ETZoQdOB7OwXCPQ@mail.gmail.com/T/#m71f37f3985f2abd7209c8ca8e0fa4edc45e171d6
> Co-developed-by: Brendan Higgins <brendanhiggins@google.com>
> Signed-off-by: Brendan Higgins <brendanhiggins@google.com>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Fixes the lib/test_printf.ko use-after-free on linux-next 20200410
that I reported last week.
> ---
>
> This patch is based on the diff written by Heikki linked above.
>
> Heikki, can you either reply with a Signed-off-by? Otherwise, I can
> resend with me as the author and I will list you as the Co-developed-by.
>
> Sorry for all the CCs: I just want to make sure everyone who was a party
> to the original bug sees this.
>
> ---
> lib/kobject.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/lib/kobject.c b/lib/kobject.c
> index 83198cb37d8d..5921e2470b46 100644
> --- a/lib/kobject.c
> +++ b/lib/kobject.c
> @@ -663,6 +663,7 @@ EXPORT_SYMBOL(kobject_get_unless_zero);
> */
> static void kobject_cleanup(struct kobject *kobj)
> {
> + struct kobject *parent = kobj->parent;
> struct kobj_type *t = get_ktype(kobj);
> const char *name = kobj->name;
>
> @@ -680,6 +681,9 @@ static void kobject_cleanup(struct kobject *kobj)
> kobject_uevent(kobj, KOBJ_REMOVE);
> }
>
> + /* make sure the parent is not released before the (last) child */
> + kobject_get(parent);
> +
> /* remove from sysfs if the caller did not do it */
> if (kobj->state_in_sysfs) {
> pr_debug("kobject: '%s' (%p): auto cleanup kobject_del\n",
> @@ -693,6 +697,8 @@ static void kobject_cleanup(struct kobject *kobj)
> t->release(kobj);
> }
>
> + kobject_put(parent);
> +
> /* free name if we allocated it */
> if (name) {
> pr_debug("kobject: '%s': free name\n", name);
>
> base-commit: 8632e9b5645bbc2331d21d892b0d6961c1a08429
>
Thanks.
--
~Randy
next prev parent reply other threads:[~2020-04-14 22:39 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-14 20:42 [PATCH v1] kobject: make sure parent is not released before children Brendan Higgins
2020-04-14 22:38 ` Randy Dunlap [this message]
2020-04-15 6:11 ` Greg KH
2020-04-15 8:46 ` Heikki Krogerus
2020-04-15 9:21 ` Rafael J. Wysocki
2020-04-15 13:10 ` Heikki Krogerus
2020-04-15 13:31 ` Greg KH
2020-04-17 11:39 ` Heikki Krogerus
2020-04-17 16:08 ` Randy Dunlap
2020-04-20 22:03 ` Brendan Higgins
2020-04-15 9:21 ` Greg KH
2020-04-15 11:25 ` Heikki Krogerus
2020-04-15 12:12 ` Greg KH
2020-04-15 8:18 ` Heikki Krogerus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=71775e76-6175-d64b-0f4e-1beeb6b589b3@infradead.org \
--to=rdunlap@infradead.org \
--cc=anders.roxell@linaro.org \
--cc=andriy.shevchenko@linux.intel.com \
--cc=andy.shevchenko@gmail.com \
--cc=brendanhiggins@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=hdegoede@redhat.com \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=lkft-triage@lists.linaro.org \
--cc=naresh.kamboju@linaro.org \
--cc=rafael.j.wysocki@intel.com \
--cc=rafael@kernel.org \
--cc=rostedt@goodmis.org \
--cc=sakari.ailus@linux.intel.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=shuah@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).