* [PATCH] driver: soc: xilinx: use _safe loop iterator to avoid a use after free
@ 2023-04-21 10:44 Dan Carpenter
2023-05-12 11:08 ` Michal Simek
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2023-04-21 10:44 UTC (permalink / raw)
To: Abhyuday Godhasara
Cc: Michal Simek, Rajan Vaja, Greg Kroah-Hartman, Tejas Patel,
linux-arm-kernel, linux-kernel, kernel-janitors
The hash_for_each_possible() loop dereferences "eve_data" to get the
next item on the list. However the loop frees eve_data so it leads to
a use after free. Use hash_for_each_possible_safe() instead.
Fixes: c7fdb2404f66 ("drivers: soc: xilinx: add xilinx event management driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
Found by static analysis and not tested.
drivers/soc/xilinx/xlnx_event_manager.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
index c76381899ef4..f9d9b82b562d 100644
--- a/drivers/soc/xilinx/xlnx_event_manager.c
+++ b/drivers/soc/xilinx/xlnx_event_manager.c
@@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun)
struct registered_event_data *eve_data;
struct agent_cb *cb_pos;
struct agent_cb *cb_next;
+ struct hlist_node *tmp;
is_need_to_unregister = false;
/* Check for existing entry in hash table for given cb_type */
- hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) {
+ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) {
if (eve_data->cb_type == PM_INIT_SUSPEND_CB) {
/* Delete the list of callback */
list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
@@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event,
u64 key = ((u64)node_id << 32U) | (u64)event;
struct agent_cb *cb_pos;
struct agent_cb *cb_next;
+ struct hlist_node *tmp;
is_need_to_unregister = false;
/* Check for existing entry in hash table for given key id */
- hash_for_each_possible(reg_driver_map, eve_data, hentry, key) {
+ hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) {
if (eve_data->key == key) {
/* Delete the list of callback */
list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
--
2.39.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] driver: soc: xilinx: use _safe loop iterator to avoid a use after free
2023-04-21 10:44 [PATCH] driver: soc: xilinx: use _safe loop iterator to avoid a use after free Dan Carpenter
@ 2023-05-12 11:08 ` Michal Simek
0 siblings, 0 replies; 2+ messages in thread
From: Michal Simek @ 2023-05-12 11:08 UTC (permalink / raw)
To: Dan Carpenter, Abhyuday Godhasara
Cc: Michal Simek, Rajan Vaja, Greg Kroah-Hartman, Tejas Patel,
linux-arm-kernel, linux-kernel, kernel-janitors
On 4/21/23 12:44, Dan Carpenter wrote:
> CAUTION: This message has originated from an External Source. Please use proper judgment and caution when opening attachments, clicking links, or responding to this email.
>
>
> The hash_for_each_possible() loop dereferences "eve_data" to get the
> next item on the list. However the loop frees eve_data so it leads to
> a use after free. Use hash_for_each_possible_safe() instead.
>
> Fixes: c7fdb2404f66 ("drivers: soc: xilinx: add xilinx event management driver")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> Found by static analysis and not tested.
>
> drivers/soc/xilinx/xlnx_event_manager.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
> index c76381899ef4..f9d9b82b562d 100644
> --- a/drivers/soc/xilinx/xlnx_event_manager.c
> +++ b/drivers/soc/xilinx/xlnx_event_manager.c
> @@ -192,11 +192,12 @@ static int xlnx_remove_cb_for_suspend(event_cb_func_t cb_fun)
> struct registered_event_data *eve_data;
> struct agent_cb *cb_pos;
> struct agent_cb *cb_next;
> + struct hlist_node *tmp;
>
> is_need_to_unregister = false;
>
> /* Check for existing entry in hash table for given cb_type */
> - hash_for_each_possible(reg_driver_map, eve_data, hentry, PM_INIT_SUSPEND_CB) {
> + hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, PM_INIT_SUSPEND_CB) {
> if (eve_data->cb_type == PM_INIT_SUSPEND_CB) {
> /* Delete the list of callback */
> list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
> @@ -228,11 +229,12 @@ static int xlnx_remove_cb_for_notify_event(const u32 node_id, const u32 event,
> u64 key = ((u64)node_id << 32U) | (u64)event;
> struct agent_cb *cb_pos;
> struct agent_cb *cb_next;
> + struct hlist_node *tmp;
>
> is_need_to_unregister = false;
>
> /* Check for existing entry in hash table for given key id */
> - hash_for_each_possible(reg_driver_map, eve_data, hentry, key) {
> + hash_for_each_possible_safe(reg_driver_map, eve_data, tmp, hentry, key) {
> if (eve_data->key == key) {
> /* Delete the list of callback */
> list_for_each_entry_safe(cb_pos, cb_next, &eve_data->cb_list_head, list) {
> --
> 2.39.2
>
Applied.
M
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-05-12 11:09 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-04-21 10:44 [PATCH] driver: soc: xilinx: use _safe loop iterator to avoid a use after free Dan Carpenter
2023-05-12 11:08 ` Michal Simek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).