Re: [PATCH] cpufreq: Fix an use-after-free in gov_attr_set_put

["Rafael J. Wysocki" <rafael@kernel.org>]

On Tue, Sep 14, 2021 at 10:37 PM Qian Cai <quic_qiancai@quicinc.com> wrote:
>
> A recent commit started to call sugov_tunables_free() in
> kobject_release() which results in an use-after-free when
> mutex_destroy() is called later in gov_attr_set_put(). Fixed it by
> calling mutex_destroy() before kobject_put().
>
> BUG: KASAN: use-after-free in mutex_is_locked+0x24/0x60
> Read of size 8 at addr ffff000877717950 by task cpuhp/0/15
>
> Call trace:
>  dump_backtrace+0x0/0x3b8
>  show_stack+0x20/0x30
>  dump_stack_lvl+0x8c/0xb8
>  print_address_description.constprop.0+0x74/0x3c8
>  kasan_report+0x1f0/0x208
>  kasan_check_range+0x100/0x1b8
>  __kasan_check_read+0x34/0x60
>  mutex_is_locked+0x24/0x60
>  mutex_destroy+0x7c/0xf8
>  gov_attr_set_put+0x140/0x1b0
>  sugov_exit+0x7c/0x198
>  cpufreq_exit_governor+0x78/0x178
>  cpufreq_offline+0x2f8/0x6f8
>  cpuhp_cpufreq_offline+0x18/0x28
>  cpuhp_invoke_callback+0x51c/0x2ab8
>  cpuhp_thread_fun+0x204/0x588
>  smpboot_thread_fn+0x3f0/0xc40
>  kthread+0x3bc/0x470
>  ret_from_fork+0x10/0x20
>
> Allocated by task 638:
>  kasan_save_stack+0x28/0x58
>  __kasan_kmalloc+0x8c/0xb0
>  kmem_cache_alloc_trace+0x21c/0x358
>  sugov_init+0x478/0x768
>  cpufreq_init_governor+0x11c/0x318
>  cpufreq_set_policy+0x5d0/0xd88
>  cpufreq_online+0x72c/0x1938
>  cpufreq_add_dev+0x154/0x1a8
>  subsys_interface_register+0x218/0x360
>  cpufreq_register_driver+0x2a4/0x4c0
>  0xffff8000098d0348
>  do_one_initcall+0x160/0xb48
>  do_init_module+0x18c/0x648
>  load_module+0x2614/0x3238
>  __do_sys_finit_module+0x118/0x1a8
>  __arm64_sys_finit_module+0x74/0xa8
>  invoke_syscall.constprop.0+0xdc/0x1d8
>  do_el0_svc+0x1f8/0x298
>  el0_svc+0x64/0x130
>  el0t_64_sync_handler+0xb0/0xb8
>  el0t_64_sync+0x180/0x184
>
> Freed by task 15:
>  kasan_save_stack+0x28/0x58
>  kasan_set_track+0x28/0x40
>  kasan_set_free_info+0x28/0x50
>  __kasan_slab_free+0xfc/0x150
>  slab_free_freelist_hook+0x108/0x200
>  kfree+0x13c/0x3b8
>  sugov_tunables_free+0x18/0x28
>  kobject_release+0xe4/0x360
>  kobject_put+0x7c/0x138
>  gov_attr_set_put+0x138/0x1b0
>  sugov_exit+0x7c/0x198
>  cpufreq_exit_governor+0x78/0x178
>  cpufreq_offline+0x2f8/0x6f8
>  cpuhp_cpufreq_offline+0x18/0x28
>  cpuhp_invoke_callback+0x51c/0x2ab8
>  cpuhp_thread_fun+0x204/0x588
>  smpboot_thread_fn+0x3f0/0xc40
>  kthread+0x3bc/0x470
>  ret_from_fork+0x10/0x20
>
> The buggy address belongs to the object at ffff000877717900
>                 which belongs to the cache kmalloc-256 of size 256
> The buggy address is located 80 bytes inside of
>                 256-byte region [ffff000877717900, ffff000877717a00)
> The buggy address belongs to the page:
> page:ffffffc0021ddc40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8f771
> flags: 0x7ffff800000200(slab|node=0|zone=0|lastcpupid=0xfffff)
> raw: 007ffff800000200 ffffffc0021a6508 ffffffc0022bd488 ffff000012910980
> raw: 0000000000000000 0000000000400040 00000001ffffffff 0000000000000000
> page dumped because: kasan: bad access detected
>
> Memory state around the buggy address:
>  ffff000877717800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  ffff000877717880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> >ffff000877717900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>                                                  ^
>  ffff000877717980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>  ffff000877717a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>
> Fixes: e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables")
> Signed-off-by: Qian Cai <quic_qiancai@quicinc.com>
> ---
>  drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/cpufreq/cpufreq_governor_attr_set.c b/drivers/cpufreq/cpufreq_governor_attr_set.c
> index 66b05a326910..a6f365b9cc1a 100644
> --- a/drivers/cpufreq/cpufreq_governor_attr_set.c
> +++ b/drivers/cpufreq/cpufreq_governor_attr_set.c
> @@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *l
>         if (count)
>                 return count;
>
> -       kobject_put(&attr_set->kobj);
>         mutex_destroy(&attr_set->update_lock);
> +       kobject_put(&attr_set->kobj);

Another patch fixing this issue has been queued up already:
https://patchwork.kernel.org/project/linux-pm/patch/20210914165623.18972-1-james.morse@arm.com/

Thanks!

>         return 0;
>  }
>  EXPORT_SYMBOL_GPL(gov_attr_set_put);
> --
> 2.25.1
>