From: "Rafael J. Wysocki" <rafael@kernel.org>
To: Ziyang Xuan <william.xuanziyang@huawei.com>,
Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>,
Amit Kucheria <amitk@kernel.org>,
"Zhang, Rui" <rui.zhang@intel.com>,
Linux PM <linux-pm@vger.kernel.org>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH v2] thermal/core: fix a UAF bug in __thermal_cooling_device_register()
Date: Fri, 15 Oct 2021 14:25:03 +0200 [thread overview]
Message-ID: <CAJZ5v0h5-P+br-+44hv82jKdd=5Y-46daXMWLwsg9WDoEfG17g@mail.gmail.com> (raw)
In-Reply-To: <20211015024504.947520-1-william.xuanziyang@huawei.com>
On Fri, Oct 15, 2021 at 4:46 AM Ziyang Xuan
<william.xuanziyang@huawei.com> wrote:
>
> When device_register() return failed, program will goto out_kfree_type
> to release 'cdev->device' by put_device(). That will call thermal_release()
> to free 'cdev'. But the follow-up processes access 'cdev' continually.
> That trggers the UAF bug.
>
> ====================================================================
> BUG: KASAN: use-after-free in __thermal_cooling_device_register+0x75b/0xa90
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
> Call Trace:
> dump_stack_lvl+0xe2/0x152
> print_address_description.constprop.0+0x21/0x140
> ? __thermal_cooling_device_register+0x75b/0xa90
> kasan_report.cold+0x7f/0x11b
> ? __thermal_cooling_device_register+0x75b/0xa90
> __thermal_cooling_device_register+0x75b/0xa90
> ? memset+0x20/0x40
> ? __sanitizer_cov_trace_pc+0x1d/0x50
> ? __devres_alloc_node+0x130/0x180
> devm_thermal_of_cooling_device_register+0x67/0xf0
> max6650_probe.cold+0x557/0x6aa
> ......
>
> Freed by task 258:
> kasan_save_stack+0x1b/0x40
> kasan_set_track+0x1c/0x30
> kasan_set_free_info+0x20/0x30
> __kasan_slab_free+0x109/0x140
> kfree+0x117/0x4c0
> thermal_release+0xa0/0x110
> device_release+0xa7/0x240
> kobject_put+0x1ce/0x540
> put_device+0x20/0x30
> __thermal_cooling_device_register+0x731/0xa90
> devm_thermal_of_cooling_device_register+0x67/0xf0
> max6650_probe.cold+0x557/0x6aa [max6650]
>
> Do not use 'cdev' again after put_device() to fix the problem like doing
> in thermal_zone_device_register().
>
> Fixes: 584837618100 ("thermal/drivers/core: Use a char pointer for the cooling device name")
> Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: kernel test robot <lkp@intel.com>
> ---
> drivers/thermal/thermal_core.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
> index 97ef9b040b84..d2c196b298c1 100644
> --- a/drivers/thermal/thermal_core.c
> +++ b/drivers/thermal/thermal_core.c
> @@ -888,7 +888,7 @@ __thermal_cooling_device_register(struct device_node *np,
> {
> struct thermal_cooling_device *cdev;
> struct thermal_zone_device *pos = NULL;
> - int ret;
> + int id, ret;
>
> if (!ops || !ops->get_max_state || !ops->get_cur_state ||
> !ops->set_cur_state)
> @@ -901,7 +901,7 @@ __thermal_cooling_device_register(struct device_node *np,
> ret = ida_simple_get(&thermal_cdev_ida, 0, 0, GFP_KERNEL);
> if (ret < 0)
> goto out_kfree_cdev;
> - cdev->id = ret;
> + cdev->id = id = ret;
I'd prefer this to be two statements, but I can fix it up.
Daniel, would there be any issues if I applied it?
>
> cdev->type = kstrdup(type ? type : "", GFP_KERNEL);
> if (!cdev->type) {
> @@ -942,8 +942,9 @@ __thermal_cooling_device_register(struct device_node *np,
> out_kfree_type:
> kfree(cdev->type);
> put_device(&cdev->device);
> + cdev = NULL;
> out_ida_remove:
> - ida_simple_remove(&thermal_cdev_ida, cdev->id);
> + ida_simple_remove(&thermal_cdev_ida, id);
> out_kfree_cdev:
> kfree(cdev);
> return ERR_PTR(ret);
> --
> 2.25.1
>
next prev parent reply other threads:[~2021-10-15 12:25 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-15 2:45 [PATCH v2] thermal/core: fix a UAF bug in __thermal_cooling_device_register() Ziyang Xuan
2021-10-15 12:25 ` Rafael J. Wysocki [this message]
2021-10-18 1:26 ` Ziyang Xuan (William)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJZ5v0h5-P+br-+44hv82jKdd=5Y-46daXMWLwsg9WDoEfG17g@mail.gmail.com' \
--to=rafael@kernel.org \
--cc=amitk@kernel.org \
--cc=daniel.lezcano@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pm@vger.kernel.org \
--cc=rui.zhang@intel.com \
--cc=william.xuanziyang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).