From: Dmitry Osipenko <digetx@gmail.com>
To: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Rafael Wysocki <rjw@rjwysocki.net>,
linux-pm@vger.kernel.org,
Vincent Guittot <vincent.guittot@linaro.org>,
mka@chromium.org, ulf.hansson@linaro.org, sfr@canb.auug.org.au,
pavel@ucw.cz, "Rafael J . Wysocki" <rafael.j.wysocki@intel.com>,
linux-kernel@vger.kernel.org, linux-tegra@vger.kernel.org
Subject: Re: [PATCH V7 5/7] cpufreq: Register notifiers with the PM QoS framework
Date: Mon, 23 Sep 2019 20:27:51 +0300 [thread overview]
Message-ID: <16bfccc5-36d5-3050-fd8d-5bce59e2d7b3@gmail.com> (raw)
In-Reply-To: <20190923135654.wcsdl5jdzxqeht3l@vireshk-mac-ubuntu>
23.09.2019 16:56, Viresh Kumar пишет:
> On 22-09-19, 23:12, Dmitry Osipenko wrote:
>> This patch causes use-after-free on a cpufreq driver module reload. Please take a look, thanks in advance.
>>
>>
>> [ 87.952369] ==================================================================
>> [ 87.953259] BUG: KASAN: use-after-free in notifier_chain_register+0x4f/0x9c
>> [ 87.954031] Read of size 4 at addr e6abbd0c by task modprobe/243
>>
>> [ 87.954901] CPU: 1 PID: 243 Comm: modprobe Tainted: G W
>> 5.3.0-next-20190920-00185-gf61698eab956-dirty #2408
>> [ 87.956077] Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
>> [ 87.956807] [<c0110aad>] (unwind_backtrace) from [<c010bb71>] (show_stack+0x11/0x14)
>> [ 87.957709] [<c010bb71>] (show_stack) from [<c0d37b25>] (dump_stack+0x89/0x98)
>> [ 87.958616] [<c0d37b25>] (dump_stack) from [<c02937e1>]
>> (print_address_description.constprop.0+0x3d/0x340)
>> [ 87.959785] [<c02937e1>] (print_address_description.constprop.0) from [<c0293c6b>]
>> (__kasan_report+0xe3/0x12c)
>> [ 87.960907] [<c0293c6b>] (__kasan_report) from [<c014988f>] (notifier_chain_register+0x4f/0x9c)
>> [ 87.962001] [<c014988f>] (notifier_chain_register) from [<c01499b5>]
>> (blocking_notifier_chain_register+0x29/0x3c)
>> [ 87.963180] [<c01499b5>] (blocking_notifier_chain_register) from [<c06f7ee9>]
>> (dev_pm_qos_add_notifier+0x79/0xf8)
>> [ 87.964339] [<c06f7ee9>] (dev_pm_qos_add_notifier) from [<c092927d>] (cpufreq_online+0x5e1/0x8a4)
>
> Hi Dmitry,
>
> Unfortunately I am traveling right now and can't test this stuff, though I may
> have found the root cause here. Can you please test the below diff for me ?
>
> diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
> index 6c90fd7e2ff8..9ac244ee05fe 100644
> --- a/drivers/base/power/qos.c
> +++ b/drivers/base/power/qos.c
> @@ -328,6 +328,8 @@ void dev_pm_qos_constraints_destroy(struct device *dev)
> spin_unlock_irq(&dev->power.lock);
>
> kfree(qos->resume_latency.notifiers);
> + kfree(qos->min_frequency.notifiers);
> + kfree(qos->max_frequency.notifiers);
> kfree(qos);
>
> out:
>
Doesn't help. The use-after-free bugs are usually caused by a missing
NULL assignment after kfree(), like in this snippet:
..
if (!a)
a = kmalloc();
..
kfree(a);
// a = NULL <-- missing!
..
I briefly looked through the code and don't see anything obviously
wrong. The bug isn't critical since unlikely that somebody reloads
cpufreq module for a non-development purposes, so it's not a big deal
and can wait. Please take your time.
I also want to point out that kernel crashes after second module reload,
hence the KASAN report should be valid.
next prev parent reply other threads:[~2019-09-23 17:27 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-04 7:36 [PATCH V6 0/7] cpufreq: Use QoS layer to manage freq-constraints Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 1/7] PM / QOS: Pass request type to dev_pm_qos_{add|remove}_notifier() Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 2/7] PM / QOS: Rename __dev_pm_qos_read_value() and dev_pm_qos_raw_read_value() Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 3/7] PM / QOS: Pass request type to dev_pm_qos_read_value() Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 4/7] PM / QoS: Add support for MIN/MAX frequency constraints Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 5/7] cpufreq: Register notifiers with the PM QoS framework Viresh Kumar
2019-07-08 10:57 ` [PATCH V7 " Viresh Kumar
2019-09-22 20:12 ` Dmitry Osipenko
2019-09-23 13:56 ` Viresh Kumar
2019-09-23 17:27 ` Dmitry Osipenko [this message]
2019-10-14 9:42 ` Viresh Kumar
2019-10-14 13:01 ` Dmitry Osipenko
2019-10-15 11:46 ` Viresh Kumar
2019-10-15 13:45 ` Dmitry Osipenko
2019-10-15 15:53 ` Rafael J. Wysocki
2019-10-15 21:50 ` Rafael J. Wysocki
2019-10-16 8:27 ` Viresh Kumar
2019-10-16 8:43 ` Rafael J. Wysocki
2019-07-04 7:36 ` [PATCH V6 6/7] cpufreq: intel_pstate: Reuse refresh_frequency_limits() Viresh Kumar
2019-07-04 7:36 ` [PATCH V6 7/7] cpufreq: Add QoS requests for userspace constraints Viresh Kumar
2019-07-05 10:51 ` [PATCH V7 " Viresh Kumar
2019-07-05 11:17 ` Rafael J. Wysocki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=16bfccc5-36d5-3050-fd8d-5bce59e2d7b3@gmail.com \
--to=digetx@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=mka@chromium.org \
--cc=pavel@ucw.cz \
--cc=rafael.j.wysocki@intel.com \
--cc=rjw@rjwysocki.net \
--cc=sfr@canb.auug.org.au \
--cc=ulf.hansson@linaro.org \
--cc=vincent.guittot@linaro.org \
--cc=viresh.kumar@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).