linux-spi.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 0/6] Fix use-after-free in SPI drivers
@ 2020-09-22  9:32 Sascha Hauer
  2020-09-22  9:32 ` [PATCH 1/6] spi: fsl-dspi: Use devm_spi_register_controller() Sascha Hauer
                   ` (6 more replies)
  0 siblings, 7 replies; 12+ messages in thread
From: Sascha Hauer @ 2020-09-22  9:32 UTC (permalink / raw)
  To: linux-spi
  Cc: Mark Brown, Nicolas Ferre, Nicolas Saenz Julienne,
	Vladimir Oltean, Daniel Mack, kernel, Sascha Hauer

Several SPI drivers continue to use private driver data after it has
been freed in spi_unregister_controller(). This results in a
use-after-free trace in KASan, see below for an example on the fsl-dspi
driver. This series fixes this on all drivers which follow the same
pattern. It is runtime tested on a Layerscape SoC with the fsl-dspi
driver, patches for the other drivers have been compile tested only.

=================================================================
BUG: KASAN: use-after-free in dspi_remove+0x48/0x1f8
Read of size 8 at addr ffff0009301b7610 by task systemd-shutdow/1

CPU: 3 PID: 1 Comm: systemd-shutdow Not tainted 5.9.0-rc2-00019-g74a89d7f9ed7 #22
Hardware name: TQ TQMLS1046A SoM on Arkona AT1130 (C300) board (DT)
Call trace:
 dump_backtrace+0x0/0x2b0
 show_stack+0x14/0x20
 dump_stack+0xe8/0x150
 print_address_description.constprop.0+0x6c/0x4e0
 kasan_report+0x130/0x1f8
 __asan_load8+0x88/0xc0
 dspi_remove+0x48/0x1f8
 dspi_shutdown+0xc/0x18
 platform_drv_shutdown+0x34/0x40
 device_shutdown+0x1ec/0x420
 kernel_restart_prepare+0x40/0x50
 kernel_restart+0x14/0x60
 __do_sys_reboot+0x294/0x2c0
 __arm64_sys_reboot+0x50/0x60
 el0_svc_common.constprop.0+0xa0/0x1d8
 do_el0_svc_compat+0x2c/0x58
 el0_sync_compat_handler+0x94/0x184
 el0_sync_compat+0x144/0x180

 Allocated by task 1:
 kasan_save_stack+0x24/0x50
 __kasan_kmalloc.isra.0+0xc0/0xe0
 kasan_kmalloc+0xc/0x18
 __kmalloc+0x208/0x360
 __spi_alloc_controller+0x2c/0xe8
 dspi_probe+0xb0/0xcc8
 platform_drv_probe+0x6c/0xc8
 really_probe+0x144/0x510
 driver_probe_device+0xc8/0xe0
 device_driver_attach+0x94/0xa0
 __driver_attach+0x70/0x110
 bus_for_each_dev+0xe4/0x158
 driver_attach+0x30/0x40
 bus_add_driver+0x21c/0x2b8
 driver_register+0xbc/0x1d0
 __platform_driver_register+0x7c/0x88
 fsl_dspi_driver_init+0x18/0x20
 do_one_initcall+0xa4/0x24c
 kernel_init_freeable+0x26c/0x2d4
 kernel_init+0x10/0x11c
 ret_from_fork+0x10/0x18

 Freed by task 1:
 kasan_save_stack+0x24/0x50
 kasan_set_track+0x24/0x38
 kasan_set_free_info+0x20/0x40
 __kasan_slab_free+0xfc/0x170
 kasan_slab_free+0x10/0x18
 kfree+0xac/0x318
 spi_controller_release+0xc/0x18
 device_release+0x7c/0xf0
 kobject_put+0xa4/0x170
 device_unregister+0x20/0x30
 spi_unregister_controller+0x104/0x178
 dspi_remove+0x40/0x1f8
 dspi_shutdown+0xc/0x18
 platform_drv_shutdown+0x34/0x40
 device_shutdown+0x1ec/0x420
 kernel_restart_prepare+0x40/0x50
 kernel_restart+0x14/0x60
 __do_sys_reboot+0x294/0x2c0
 __arm64_sys_reboot+0x50/0x60
 el0_svc_common.constprop.0+0xa0/0x1d8
 do_el0_svc_compat+0x2c/0x58
 el0_sync_compat_handler+0x94/0x184
 el0_sync_compat+0x144/0x180

The buggy address belongs to the object at ffff0009301b7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1552 bytes inside of
 2048-byte region [ffff0009301b7000, ffff0009301b7800)
The buggy address belongs to the page:
page:00000000debc463d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9b01b0
head:00000000debc463d order:3 compound_mapcount:0 compound_pincount:0
flags: 0x2ffff00000010200(slab|head)
raw: 2ffff00000010200 dead000000000100 dead000000000122 ffff000932003680
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0009301b7500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0009301b7580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0009301b7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff0009301b7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0009301b7700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Sascha Hauer (6):
  spi: fsl-dspi: Use devm_spi_register_controller()
  spi: atmel-quadspi: Use devm_spi_register_controller()
  spi: bcm2835: Use devm_spi_register_controller()
  spi: dw: Use devm_spi_register_controller()
  spi: pxa2xx: Use devm_spi_register_controller()
  spi: rpc-if: Use devm_spi_register_controller()

 drivers/spi/atmel-quadspi.c | 3 +--
 drivers/spi/spi-bcm2835.c   | 4 +---
 drivers/spi/spi-dw-core.c   | 4 +---
 drivers/spi/spi-fsl-dspi.c  | 5 +----
 drivers/spi/spi-pxa2xx.c    | 4 +---
 drivers/spi/spi-rpc-if.c    | 3 +--
 6 files changed, 6 insertions(+), 17 deletions(-)

-- 
2.28.0


^ permalink raw reply	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2020-10-15  5:53 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-09-22  9:32 [PATCH 0/6] Fix use-after-free in SPI drivers Sascha Hauer
2020-09-22  9:32 ` [PATCH 1/6] spi: fsl-dspi: Use devm_spi_register_controller() Sascha Hauer
2020-09-22  9:44   ` Mark Brown
2020-09-22 11:06     ` Sascha Hauer
2020-09-22 11:25       ` Mark Brown
2020-09-22  9:32 ` [PATCH 2/6] spi: atmel-quadspi: " Sascha Hauer
2020-09-22  9:32 ` [PATCH 3/6] spi: bcm2835: " Sascha Hauer
2020-09-22  9:39   ` Nicolas Saenz Julienne
2020-09-22  9:32 ` [PATCH 4/6] spi: dw: " Sascha Hauer
2020-09-22  9:32 ` [PATCH 5/6] spi: pxa2xx: " Sascha Hauer
2020-09-22  9:32 ` [PATCH 6/6] spi: rpc-if: " Sascha Hauer
2020-10-15  5:44 ` [PATCH 0/6] Fix use-after-free in SPI drivers Lukas Wunner

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).