Stable Archive on lore.kernel.org
 help / color / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Sasha Levin <sashal@kernel.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
	Muchun Song <smuchun@gmail.com>,
	Mukesh Ojha <mojha@codeaurora.org>,
	Prateek Sood <prsood@codeaurora.org>
Subject: Re: [PATCH AUTOSEL 4.14 18/44] driver core: Fix use-after-free and double free on glue directory
Date: Wed, 14 Aug 2019 09:37:00 +0200
Message-ID: <20190814073700.GC23414@kroah.com> (raw)
In-Reply-To: <20190814021834.16662-18-sashal@kernel.org>

On Tue, Aug 13, 2019 at 10:18:07PM -0400, Sasha Levin wrote:
> From: Muchun Song <smuchun@gmail.com>
> 
> [ Upstream commit ac43432cb1f5c2950408534987e57c2071e24d8f ]
> 
> There is a race condition between removing glue directory and adding a new
> device under the glue dir. It can be reproduced in following test:
> 
> CPU1:                                         CPU2:
> 
> device_add()
>   get_device_parent()
>     class_dir_create_and_add()
>       kobject_add_internal()
>         create_dir()    // create glue_dir
> 
>                                               device_add()
>                                                 get_device_parent()
>                                                   kobject_get() // get glue_dir
> 
> device_del()
>   cleanup_glue_dir()
>     kobject_del(glue_dir)
> 
>                                                 kobject_add()
>                                                   kobject_add_internal()
>                                                     create_dir() // in glue_dir
>                                                       sysfs_create_dir_ns()
>                                                         kernfs_create_dir_ns(sd)
> 
>       sysfs_remove_dir() // glue_dir->sd=NULL
>       sysfs_put()        // free glue_dir->sd
> 
>                                                           // sd is freed
>                                                           kernfs_new_node(sd)
>                                                             kernfs_get(glue_dir)
>                                                             kernfs_add_one()
>                                                             kernfs_put()
> 
> Before CPU1 remove last child device under glue dir, if CPU2 add a new
> device under glue dir, the glue_dir kobject reference count will be
> increase to 2 via kobject_get() in get_device_parent(). And CPU2 has
> been called kernfs_create_dir_ns(), but not call kernfs_new_node().
> Meanwhile, CPU1 call sysfs_remove_dir() and sysfs_put(). This result in
> glue_dir->sd is freed and it's reference count will be 0. Then CPU2 call
> kernfs_get(glue_dir) will trigger a warning in kernfs_get() and increase
> it's reference count to 1. Because glue_dir->sd is freed by CPU1, the next
> call kernfs_add_one() by CPU2 will fail(This is also use-after-free)
> and call kernfs_put() to decrease reference count. Because the reference
> count is decremented to 0, it will also call kmem_cache_free() to free
> the glue_dir->sd again. This will result in double free.
> 
> In order to avoid this happening, we also should make sure that kernfs_node
> for glue_dir is released in CPU1 only when refcount for glue_dir kobj is
> 1 to fix this race.
> 
> The following calltrace is captured in kernel 4.14 with the following patch
> applied:
> 
> commit 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier")
> 
> --------------------------------------------------------------------------
> [    3.633703] WARNING: CPU: 4 PID: 513 at .../fs/kernfs/dir.c:494
>                 Here is WARN_ON(!atomic_read(&kn->count) in kernfs_get().
> ....
> [    3.633986] Call trace:
> [    3.633991]  kernfs_create_dir_ns+0xa8/0xb0
> [    3.633994]  sysfs_create_dir_ns+0x54/0xe8
> [    3.634001]  kobject_add_internal+0x22c/0x3f0
> [    3.634005]  kobject_add+0xe4/0x118
> [    3.634011]  device_add+0x200/0x870
> [    3.634017]  _request_firmware+0x958/0xc38
> [    3.634020]  request_firmware_into_buf+0x4c/0x70
> ....
> [    3.634064] kernel BUG at .../mm/slub.c:294!
>                 Here is BUG_ON(object == fp) in set_freepointer().
> ....
> [    3.634346] Call trace:
> [    3.634351]  kmem_cache_free+0x504/0x6b8
> [    3.634355]  kernfs_put+0x14c/0x1d8
> [    3.634359]  kernfs_create_dir_ns+0x88/0xb0
> [    3.634362]  sysfs_create_dir_ns+0x54/0xe8
> [    3.634366]  kobject_add_internal+0x22c/0x3f0
> [    3.634370]  kobject_add+0xe4/0x118
> [    3.634374]  device_add+0x200/0x870
> [    3.634378]  _request_firmware+0x958/0xc38
> [    3.634381]  request_firmware_into_buf+0x4c/0x70
> --------------------------------------------------------------------------
> 
> Fixes: 726e41097920 ("drivers: core: Remove glue dirs from sysfs earlier")
> Signed-off-by: Muchun Song <smuchun@gmail.com>
> Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
> Signed-off-by: Prateek Sood <prsood@codeaurora.org>
> Link: https://lore.kernel.org/r/20190727032122.24639-1-smuchun@gmail.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/base/core.c | 53 ++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 52 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/core.c b/drivers/base/core.c
> index 1c67bf24bc23c..2ec9af90cd28e 100644
> --- a/drivers/base/core.c
> +++ b/drivers/base/core.c
> @@ -1572,12 +1572,63 @@ static inline struct kobject *get_glue_dir(struct device *dev)
>   */
>  static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
>  {
> +	unsigned int ref;
> +
>  	/* see if we live in a "glue" directory */
>  	if (!live_in_glue_dir(glue_dir, dev))
>  		return;
>  
>  	mutex_lock(&gdp_mutex);
> -	if (!kobject_has_children(glue_dir))
> +	/**
> +	 * There is a race condition between removing glue directory
> +	 * and adding a new device under the glue directory.
> +	 *
> +	 * CPU1:                                         CPU2:
> +	 *
> +	 * device_add()
> +	 *   get_device_parent()
> +	 *     class_dir_create_and_add()
> +	 *       kobject_add_internal()
> +	 *         create_dir()    // create glue_dir
> +	 *
> +	 *                                               device_add()
> +	 *                                                 get_device_parent()
> +	 *                                                   kobject_get() // get glue_dir
> +	 *
> +	 * device_del()
> +	 *   cleanup_glue_dir()
> +	 *     kobject_del(glue_dir)
> +	 *
> +	 *                                               kobject_add()
> +	 *                                                 kobject_add_internal()
> +	 *                                                   create_dir() // in glue_dir
> +	 *                                                     sysfs_create_dir_ns()
> +	 *                                                       kernfs_create_dir_ns(sd)
> +	 *
> +	 *       sysfs_remove_dir() // glue_dir->sd=NULL
> +	 *       sysfs_put()        // free glue_dir->sd
> +	 *
> +	 *                                                         // sd is freed
> +	 *                                                         kernfs_new_node(sd)
> +	 *                                                           kernfs_get(glue_dir)
> +	 *                                                           kernfs_add_one()
> +	 *                                                           kernfs_put()
> +	 *
> +	 * Before CPU1 remove last child device under glue dir, if CPU2 add
> +	 * a new device under glue dir, the glue_dir kobject reference count
> +	 * will be increase to 2 in kobject_get(k). And CPU2 has been called
> +	 * kernfs_create_dir_ns(). Meanwhile, CPU1 call sysfs_remove_dir()
> +	 * and sysfs_put(). This result in glue_dir->sd is freed.
> +	 *
> +	 * Then the CPU2 will see a stale "empty" but still potentially used
> +	 * glue dir around in kernfs_new_node().
> +	 *
> +	 * In order to avoid this happening, we also should make sure that
> +	 * kernfs_node for glue_dir is released in CPU1 only when refcount
> +	 * for glue_dir kobj is 1.
> +	 */
> +	ref = kref_read(&glue_dir->kref);
> +	if (!kobject_has_children(glue_dir) && !--ref)
>  		kobject_del(glue_dir);
>  	kobject_put(glue_dir);
>  	mutex_unlock(&gdp_mutex);
> -- 
> 2.20.1
> 

Also drop here :)

and just everywhere else too please.

thanks,

greg k-h

  reply index

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-14  2:17 [PATCH AUTOSEL 4.14 01/44] iio: adc: max9611: Fix misuse of GENMASK macro Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 02/44] HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 03/44] MIPS: kernel: only use i8253 clocksource with periodic clockevent Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 04/44] mips: fix cacheinfo Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 05/44] netfilter: ebtables: fix a memory leak bug in compat Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 06/44] ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 07/44] bonding: Force slave speed check after link state recovery for 802.3ad Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 08/44] can: dev: call netif_carrier_off() in register_candev() Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 09/44] ASoC: Fail card instantiation if DAI format setup fails Sasha Levin
2019-08-14  2:17 ` [PATCH AUTOSEL 4.14 10/44] st21nfca_connectivity_event_received: null check the allocation Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 11/44] st_nci_hci_connectivity_event_received: " Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 12/44] ASoC: ti: davinci-mcasp: Correct slot_width posed constraint Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 13/44] net: usb: qmi_wwan: Add the BroadMobi BM818 card Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 14/44] qed: RDMA - Fix the hw_ver returned in device attributes Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 15/44] isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in start_isoc_chain() Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 16/44] netfilter: ipset: Fix rename concurrency with listing Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 17/44] netfilter: ebtables: also count base chain policies Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 18/44] driver core: Fix use-after-free and double free on glue directory Sasha Levin
2019-08-14  7:37   ` Greg Kroah-Hartman [this message]
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 19/44] isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on the stack Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 20/44] perf bench numa: Fix cpu0 binding Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 21/44] Input: kbtab - sanity check for endpoint type Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 22/44] net: usb: pegasus: fix improper read if get_registers() fail Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 23/44] can: sja1000: force the string buffer NULL-terminated Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 24/44] can: peak_usb: " Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 25/44] net/ethernet/qlogic/qed: " Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 26/44] NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 27/44] HID: holtek: test for sanity of intfdata Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 28/44] HID: input: fix a4tech horizontal wheel custom usage Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 29/44] SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 30/44] HID: hiddev: avoid opening a disconnected device Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 31/44] HID: hiddev: do cleanup in failure of opening a device Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 32/44] Input: iforce - add sanity checks Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 33/44] net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 34/44] net: hisilicon: make hip04_tx_reclaim non-reentrant Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 35/44] net: hisilicon: fix hip04-xmit never return TX_BUSY Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 36/44] net: hisilicon: Fix dma_map_single failed on arm64 Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 37/44] libata: have ata_scsi_rw_xlat() fail invalid passthrough requests Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 38/44] libata: add SG safety checks in SFF pio transfers Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 39/44] x86/lib/cpu: Address missing prototypes warning Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 40/44] drm/vmwgfx: fix memory leak when too many retries have occurred Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 41/44] perf ftrace: Fix failure to set cpumask when only one cpu is present Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 42/44] perf cpumap: Fix writing to illegal memory in handling cpumap mask Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 43/44] perf pmu-events: Fix missing "cpu_clk_unhalted.core" event Sasha Levin
2019-08-14  2:18 ` [PATCH AUTOSEL 4.14 44/44] selftests: kvm: Adding config fragments Sasha Levin

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190814073700.GC23414@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mojha@codeaurora.org \
    --cc=prsood@codeaurora.org \
    --cc=sashal@kernel.org \
    --cc=smuchun@gmail.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org stable@archiver.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/ public-inbox