From patchwork Wed May 24 17:56:21 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephan Gerhold X-Patchwork-Id: 13254453 X-Patchwork-Delegate: viresh.linux@gmail.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3A4BC77B7A for ; Wed, 24 May 2023 18:25:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237191AbjEXSZJ (ORCPT ); Wed, 24 May 2023 14:25:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54614 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237775AbjEXSZH (ORCPT ); Wed, 24 May 2023 14:25:07 -0400 X-Greylist: delayed 1712 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Wed, 24 May 2023 11:25:02 PDT Received: from mx.kernkonzept.com (serv1.kernkonzept.com [IPv6:2a01:4f8:1c1c:b490::2]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6578613E; Wed, 24 May 2023 11:25:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kernkonzept.com; s=mx1; h=Cc:To:Message-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:Subject:Date:From:References:In-Reply-To:Sender: Reply-To:Content-ID:Content-Description; bh=SPrqV6ntExTuKWUGea554T7MrMdxYL653Yvti6t/SiQ=; b=QxbJe9w+BZfDdaA+dQgy0917EL /AGNlLaD6S2fxjGnGhkr9zUNSsXN67n/7C1/hCqU7sQwp31g1SSiBKuRluPdKJdT5kVWn0TCBq/Nf coK8ehnJxJgzCvV0lSlzRBLsWcdRERV9AZiJAXE1F+EdmjsOg4BkjMEBtl59SdPZYKBslHubkmx4H FlVhfuAhpsYhGdeF4XAkcSYaz+KxChhAcyJJN7YtpfKbgPwM6yRE+nu0Y8412hCotoJqi3/QR6I1l +yqQEX13g05r68Ga3dmwVH8phbTvG2ikw+W3oYqlAaPik1WnlgJXKWIcOTZwAZjlv/aqlCbdsnbpr dHpziR2Q==; Received: from [10.22.3.24] (helo=serv1.dd1.int.kernkonzept.com) by mx.kernkonzept.com with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.94.2) id 1q1sio-002A2x-Ty; Wed, 24 May 2023 19:56:26 +0200 From: Stephan Gerhold Date: Wed, 24 May 2023 19:56:21 +0200 Subject: [PATCH] opp: Fix use-after-free in lazy_opp_tables after probe deferral MIME-Version: 1.0 Message-Id: <20230524-opp-lazy-uaf-v1-1-f5f95cb4b6de@kernkonzept.com> X-B4-Tracking: v=1; b=H4sIAMVPbmQC/x2N0QqDMAwAf0XybCCrOsRfGT6kXZyBUkuLsk389 4U93sFxJ1QpKhWm5oQih1bdksGtbSCsnF6C+jQGR66jwfW45YyRvx/cecE7MVHvu3GQAJZ4roK +cAqrRWmP0WQusuj7/3jM1/UDqZFnUnMAAAA= To: Viresh Kumar Cc: Nishanth Menon , Stephen Boyd , linux-pm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Stephan Gerhold X-Mailer: b4 0.12.2 Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until all the interconnect paths are available. However, if the OPP table is using required-opps then it may already have been added to the global lazy_opp_tables list. The error path does not remove the opp_table from the list again. This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.: Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table() Fix this by removing the opp_table from the list before freeing it. Cc: stable@vger.kernel.org Fixes: 7eba0c7641b0 ("opp: Allow lazy-linking of required-opps") Signed-off-by: Stephan Gerhold --- This fixes the crash I ran into after adding an OPP table with both "required-opps" and interconnect paths (opp-peak-kBps). By the way, the "lazy_opp_tables" does not seem to be protected by any locks(?) so I could imagine that theoretically there could be a race condition while adding/removing OPP tables there. This is unrelated to the crash I saw, though. --- drivers/opp/core.c | 1 + 1 file changed, 1 insertion(+) --- base-commit: 9e28f7a74581204807f20ae46568939038e327aa change-id: 20230524-opp-lazy-uaf-60a004b385ec Best regards, diff --git a/drivers/opp/core.c b/drivers/opp/core.c index 85cbc8de407c..6a3a320be7df 100644 --- a/drivers/opp/core.c +++ b/drivers/opp/core.c @@ -1358,6 +1358,7 @@ static struct opp_table *_allocate_opp_table(struct device *dev, int index) return opp_table; remove_opp_dev: + list_del(&opp_table->lazy); _remove_opp_dev(opp_dev, opp_table); err: kfree(opp_table);